SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Here  $\mathbf{V}$  is the set of all nodes/graphs in the dataset. It implies  $g$  will return the representation of  $\mathbf{v} \oplus \delta$  whose latent class is the same as that of the most probable instance that  $\mathbf{v} \oplus \epsilon$  is its positive sample. Therefore, consider the scenario where some noisy edges are injected into a clean input  $\mathbf{v}$ , resulting in a perturbed sample  $\mathbf{v}'$ . With a smoothed GNN encoder  $g$  learnt through our method, if we set  $\beta$  to a large value, it is highly probable that the noisy edges will be eliminated from  $\mathbf{v}'$ . Consequently, by running multiple randomized edgedrop on  $\mathbf{v}$  and  $\mathbf{v}'$ , a majority of them will possess identical structural vectors, that is,  $\mathbf{v} \oplus \epsilon = \mathbf{v}' \oplus \epsilon$ , which implies  $\mathbf{v}$  and  $\mathbf{v}'$  will have the same latent class and the robust performance of  $\mathbf{v}'$  in downstream tasks. We can then derive an upper bound on the expected difference in vote count for each class between  $\mathbf{v}$  and  $\mathbf{v}'$ . With this, we can theoretically demonstrate that  $g$  is certifiably robust at  $\mathbf{v}$  against any perturbation within a specific attack budget. Specifically, let  $p_{\mathbf{v}^{+},h}(\mathbf{v}) = \mathbb{P}(\mathbf{v} \in \mathbb{B}(\mathbf{v}^{+}); h)$  for simplicity of notation,  $\underline{p_{\mathbf{v}^{+},h}}(\mathbf{v} \oplus \epsilon)$  denotes a lower bound on  $p_{\mathbf{v}^{+},h}(\mathbf{v} \oplus \epsilon)$  with  $(1 - \alpha)$  confidence and  $\overline{p_{\mathbf{v}_i^{-},h}}(\mathbf{v} \oplus \epsilon)$  denotes a similar upper bound, the formal theorem is presented as follows:
Theorem 2. Let  $\mathbf{v}$  be a clean input and  $\mathbf{v}' = \mathbf{v} \oplus \delta$  be its perturbed version, where  $||\delta||_0 \leq k$ .  $\mathbf{V}^{-} = \{\mathbf{v}_1^{-}, \dots, \mathbf{v}_n^{-}\}$  is the set of negative samples of  $\mathbf{v}$ . If for all  $\mathbf{v}_i^{-} \in \mathbf{V}^{-}$ :
$$
\underline {{p _ {\mathbf {v} ^ {+} , h} (\mathbf {v} \oplus \epsilon)}} - \max  _ {\mathbf {v} _ {i} ^ {-} \in \mathbf {V} ^ {-}} \overline {{p _ {\mathbf {v} _ {i} ^ {-} , h} (\mathbf {v} \oplus \epsilon)}} > 2 \Delta , \tag {8}
$$
Figure 1: General Framework of training GNN encoder via RES.
where  $\Delta = 1 - \frac{\binom{d}{e}}{\binom{d + k}{e}}\cdot \beta^{k}$  and  $e = \| \mathbf{v}\oplus \epsilon \| _0$  denotes the number of remaining edges of  $\mathbf{v}$  after injecting  $\epsilon$ . Then, with a confidence level of at least  $1 - \alpha$ , we have:
$$
p _ {\mathbf {v} ^ {+}, h} \left(\mathbf {v} ^ {\prime} \oplus \epsilon\right) > \max  _ {\mathbf {v} _ {i} ^ {-} \in \mathbf {V} ^ {-}} p _ {\mathbf {v} _ {i} ^ {-}, h} \left(\mathbf {v} ^ {\prime} \oplus \epsilon\right). \tag {9}
$$
The proof is in Appendix C.2. Theorem 2 theoretically guarantees that of  $\mathbf{v}'$  is still the positive sample of  $\mathbf{v}^+$  with  $(1 - \alpha)$  confidence if the worst-case margin of  $\mathbf{v} \oplus \epsilon$  under  $h$  is larger than  $2\Delta$ , which indicates that the certified robustness of  $h$  at  $(\mathbf{v}, \mathbf{v}^+)$  is holds in this case. Moreover, it also paves us a efficient way to compute the certified perturbation size in practical (See in Sec. 5.2).
4.3 Transfer the Certified Robustness to Downstream Tasks
Though we have theoretically shown the capability of learning  $l_0^k$ -certifiably robust node/graph representations with RES, it is unclear whether the certified robustness of the smoothed GNN encoder can be preserved in downstream tasks. To address this concern, we propose a theorem that establishes a direct relationship between the certified robustness of GCL and that of downstream tasks.
Theorem 3. Given a GNN encoder  $h$  trained via GCL and an clean input  $\mathbf{v}$ .  $\mathbf{v}^{+}$  and  $\mathbf{V}^{-} = \{\mathbf{v}_{1}^{-},\dots ,\mathbf{v}_{n}^{-}\}$  are the positive sample and the set of negative samples of  $\mathbf{v}$ , respectively. Let  $c^{+}$  and  $c_{i}^{-}$  denote the latent classes of  $\mathbf{v}^{+}$  and  $\mathbf{v}_{i}^{-}$ , respectively. Suppose  $f$  is the downstream classifier that classify a data point into one of the classes in  $\mathcal{C}$ . Then, we have
$$
\mathbb {P} \left(f (h (\mathbf {v})) = c ^ {+}\right) > \max  _ {\mathbf {v} _ {i} ^ {-} \in \mathbf {V} ^ {-}} \mathbb {P} \left(f (h (\mathbf {v})) = c _ {i} ^ {-}\right) \tag {10}
$$
The proof is in Appendix C.3. By applying Theorem 3, we can prove given  $\mathbf{v}$ 's perturbed version  $\mathbf{v}' = \mathbf{v} \oplus \delta$ , where  $||\delta||_0 \leq k$ , if  $\mathbf{v}$  and  $\mathbf{v}'$  satisfy Eq. (8) and Eq. (9) in Theorem 2, we have
$$
\mathbb {P} \left(f \left(h \left(\mathbf {v} ^ {\prime} \oplus \epsilon\right)\right) = c ^ {+}\right) > \max  _ {\mathbf {v} _ {i} ^ {-} \in \mathbf {V} ^ {-}} \mathbb {P} \left(f \left(h \left(\mathbf {v} ^ {\prime} \oplus \epsilon\right)\right) = c _ {i} ^ {-}\right), \forall \| \delta \| _ {0} \leq k, \tag {11}
$$
which implies provable  $l_0^k$ -certified robustness retention of  $h$  at  $(\mathbf{v}, c^{+})$  in downstream tasks.
5 Practical Algorithms
In this section, we first propose a simple yet effective GCL method to train the GNN encoder  $h$  robustly. Then we introduce the practical algorithms for the prediction and robustness certification.
5.1 Training Robust Base Encoder
Theorem 2 holds regardless how the base GNN encoder  $h$  is trained. However, introducing randomized edgedrop noise solely to test samples during the inference phase could potentially compromise performance in downstream tasks, which further negatively impact the certified robustness performance based on Eq. 8. In order to make  $g$  can classify and certify  $(\mathbf{v}, c^{+})$  correctly and robustly, inspire by [45], we propose to train the base GNN encoder  $h$  via GCL with randomized edgedrop noise. Our key idea is to inject randomized edgedrop noise to one augmented view and maximize the probability in Eq. 5 by using GCL to maximize the agreement between two views. Fig. 1 gives an illustration of general process of training the base GNN encoder via our RES. Given an input graph  $\mathcal{G}$ , two contrasting views  $\mathcal{G}_i$  and  $\mathcal{G}_j$  are generated from  $\mathcal{G}$  through stochastic data augmentations. Specifically, two views generated from the same instance are usually considered as a positive pair, while two views constructed from different instances are considered as a negative pair. After that, we inject the randomized edgedrop noise  $\epsilon$  to one of the two views  $\mathcal{G}_i$  and obtain  $\mathcal{G}_i'$ . Finally, two GNN encoders are used to generate embeddings of the views and a contrastive loss is applied to maximize the agreement between  $\mathcal{G}_i'$  and  $\mathcal{G}_j$ . The training algorithm is summarized in Appendix D.
5.2 Prediction & Certification
Following [46, 24], we then present the algorithm to use the smoothed GNN encoder  $g(\mathbf{v})$  in the downstream tasks and derive the robustness certificates through Monte Carlo algorithms.
Prediction on Downstream Tasks. We draw  $\mu$  samples of  $h(\mathbf{v} \oplus \epsilon)$ , corrupted by randomized edge drop noises. Then we obtain their predictions via the downstream classifier. If  $c_{A}$  is the class which has the largest frequency  $\mu_{c_{A}}$  among the  $\mu$  predictions,  $c_{A}$  is returned as the final prediction.
Compute Robustness Certificates. One of robustness certificates is the certified perturbation size, which is the maximum attack budget that do not change the prediction of an instance no matter what perturbations within the budget are used. To derive the certified perturbation size of an instance  $\mathbf{v}$ , we need to estimate the lower bound  $\underline{p_{\mathbf{v}^{+},h}} (\mathbf{v}\oplus \epsilon)$  and upper bound  $\overline{p_{\mathbf{v}_i^{-},h}} (\mathbf{v}\oplus \epsilon)$  in Eq. 8. Since it is challenging to directly estimate them in GCL, inspired by Theorem 3, if the prediction of  $h(\mathbf{v}\oplus \epsilon)$  in downstream tasks is correct,  $\mathbf{v}\oplus \epsilon$  will also be the positive sample of  $\mathbf{v}$  under  $h$ , which indicates the connection between  $\underline{p_{\mathbf{v}^{+},h}} (\mathbf{v}\oplus \epsilon)$  and the probability of correctly classified in the downstream tasks. Formally, given a label set  $\mathcal{C}$  for the downstream task, let  $\underline{p_A}$  denotes the lower bound of the probability that  $h(\mathbf{v}\oplus \epsilon)$  is correctly classified as  $c_{A}\in \mathcal{C}$  in the downstream task,  $\underline{p_B}$  is the upper bound of the probability that  $h(\mathbf{v}\oplus \epsilon)$  is classified as  $c$  for  $c\in \mathcal{C}\backslash \{c_A\}$ . We have the following probability bound by a confidence level at least  $1 - \alpha$ :
$$
\underline {{p _ {\mathbf {v} ^ {+} , h}}} (\mathbf {v} \oplus \epsilon) = \underline {{p _ {A}}} = B \left(\frac {\alpha}{| \mathcal {C} |}; \mu_ {c _ {A}}, \mu - \mu_ {c _ {A}} + 1\right), \quad \overline {{p _ {\mathbf {v} _ {i} ^ {-} , h}}} (\mathbf {v} \oplus \epsilon) = \overline {{p _ {B}}} = \min  \left(\max  _ {c \neq c _ {A}} \overline {{p _ {c}}}, 1 - \underline {{p _ {A}}}\right) \tag {12}
$$
where  $\overline{p_c} = B(1 - \frac{\alpha}{|\mathcal{C}|};\mu_c + 1,\mu -\mu_c),\forall c\neq c_A$  , and  $B(q;u,w)$  is the  $q$  -th quantile of a beta distribution with shape parameter  $u$  and  $w$  . After that, we calculate  $\Delta$  based on Theorem 2 and the maximum  $k$  that satisfies Eq. 8 is the certified perturbation size.
In this section, we conduct experiments to answer the following research questions: (Q1) How robust is RES under various adversarial attacks? (Q2) Can RES effectively provide certifiable robustness for various GCL methods? (Q3) How does RES contribute to the robustness in GCL?
Datasets. We conduct experiments on 4 public benchmark datasets for node classification, i.e., Cora, Pubmed [47], Coauthor-Physics [48] and OGB-arxiv [49], and 3 widely used dataset for graph classification i.e., MUTAG, PROTEINS [50] and OGB-molhiv [49]. We use public splits for Cora and Pubmed, and for five other datasets, we perform a 10/10/80 random split for training, validation, and testing, respectively. The details and splits of these datasets are summarized in Appendix G.1.
Attack Methods. To demonstrate the robustness of RES to various structural noises, we evaluate RES on 4 types of structural attacks in an evasion setting, i.e., Random attack, Nettack [11], PRBCD [51], CLGA [16] for both node and graph classification. In our evaluation, we first train a GNN encoder on a clean dataset using GCL, and then subject RES to attacks during the inference phase by employing perturbed graphs in downstream tasks. Especially, CLGA is an poisoning attack methods for GCL. To align it with our evasion setting, we directly employ the poisoned graph generated by CLGA in downstream tasks for evaluation. The details of these attacks are given in Appendix G.2.
Compared Methods. We employ 4 state-of-the-art GCL methods, i.e., GRACE [30], BGRL [52], DGI [31] and GraphCL [9], as baselines. More specifically, GRACE, BGRL and DGI are for node classification, GraphCL and BGRL are for graph classification. We apply our RES on them to train the smoothed GNN encoders. Recall one of our goal is to validate that our method can enhance the robustness of GCL against structural noises, we also consider two robust GCL methods (i.e., Ariel [15] and GCL-Jaccard [12]) and two unsupervised methods (i.e., Node2Vec [53] and GAE [54]) as the baselines. All hyperparameters of the baselines are tuned based on the validation set to make fair comparisons. The detailed descriptions of the baselines are given in Appendix G.3
Evaluation Protocol. In this paper, we conduct experiments on both transductive node classification and inductive graph classification tasks. For each experiment, a 2-layer GCN is employed as the backbone GNN encoder. We adopt the common used linear evaluation scheme [31], where each model is firstly trained via GCL and then the resulting embeddings are used to train and test a
Table 1: Robust accuracy results for node classification.
Dataset	Graph	Node2Vec	GAE	GCL-Jac.	Ariel	GRACE	RES-GRACE
Cora	Raw	67.6±1.0	76.8±0.9	76.1±2.0	79.8±0.6	77.1±1.6	79.7±1.0
Random	57.7±0.7	74.2±0.9	74.1±2.0	76.3±0.6	74.5±2.1	79.1±1.2
CLGA	64.7±0.7	72.7±1.3	73.7±1.2	76.6±0.4	74.9±2.0	78.2±1.0
PRBCD	63.3±3.2	75.6±2.1	75.3±1.2	75.6±0.2	75.8±2.5	78.5±1.7
Pubmed	Raw	66.4±2.0	78.4±0.4	78.2±2.7	78.0±1.1	79.5±2.9	79.5±1.2
Random	56.8±1.4	71.8±1.0	75.8±2.4	75.9±0.2	75.0±1.0	78.2±0.9
CLGA	61.9±1.2	77.6±0.5	76.2±2.8	77.5±1.1	76.6±2.5	78.3±1.1
PRBCD	55.9±1.5	74.8±2.5	73.1±2.0	73.5±1.6	73.2±2.3	78.8±1.7
Physics	Raw	92.9±0.1	95.2±0.1	94.1±0.3	95.3±0.3	94.0±0.4	94.7±0.2
Random	85.7±0.3	93.7±0.1	93.4±0.3	93.8±0.1	92.6±0.5	94.2±0.3
PRBCD	81.8±0.6	91.1±0.7	91.6±0.2	91.0±0.9	89.2±0.6	94.1±0.2
OGB-arxiv	Raw	64.6±0.1	61.5±0.5	64.7±0.2	64.7±0.3	65.1±0.5	65.2±0.1
Random	52.4±0.1	57.4±0.5	59.0±0.1	59.4±0.4	59.0±0.2	60.0±0.1
PRBCD	56.5±0.5	54.1±0.5	56.5±0.4	57.0±0.9	55.7±0.4	58.3±0.4
(a) Cora
(b) OGB-arliv
(c) MUTAG
Figure 2: Certified accuracy of smoothed GCL
(d) PROTEINS
$l_{2}$ -regularized logistic regression classifier. The certified accuracy and robust accuracy on test nodes are used to evaluate the robustness performance. Specifically, certified accuracy [46, 24] denotes the fraction of correctly predicted test nodes/graphs whose certified perturbation size is no smaller than the given perturbation size. Each experiment is conducted 5 times and the average results are reported.
6.2 Performance of Robustness
To answer Q1, we compare RES with the baselines on various noisy graphs. We also conduct experiments to demonstrate that RES can improve the robustness against different noisy levels, which can be found in Appendix I.2. We focus on node classification as the downstream task on four types of noisy graphs, i.e., raw graphs, random attack perturbed graphs, CLGA perturbed graphs and PRBCD perturbed graphs. The perturbation rate of noisy graphs is 0.1. The details of the noisy graphs are presented in Appendix G.2. GRACE is used as the target GCL method to train a GCN encoder. The smoothed version of GRACE is denoted as RES-GRACE. The results on Cora, Coauthor-Physics and OGB-arxiv are given in Table 1. From the table, we observe: (i) When no attack is applied on the clean graph, our RES-GRACE achieve state-of-the-art performance, especially on large-scale datasets, which indicates RES is beneficial to learn good representation by injecting random edgedrop noise to the graph. (ii) The structural noises degrade the performances of all baselines. However, its impact to RES-GRACE is negligible. RES-GRACE outperforms all baselines including two robust GCL methods, which indicates RES could eliminate the effects of the noisy edges. More results on graph classification are shown in Appendix I.1.
6.3 Performance of Certificates
To answer Q2, we use certified accuracy as the metric to evaluate the performance of robustness certificates. We choose GCN as the GNN encoder and employ our method on GRACE [30] and GraphCL [9] for node classification and graph classification, respectively. We select the overall test nodes as the target nodes and set  $\mu = 200$ ,  $(1 - \alpha) = 99.9\%$  to compute the certified accuracy. The results for various  $\beta$  are shown in Fig. 2, where the x-axis denotes the given perturbation size. From the figures, we can observe that  $\beta$  controls the tradeoff between robustness and model utility. When  $\beta$  is larger, the certified accuracy on clean graph is larger, but it drops more quickly as the perturbation size increases. Especially, when  $\beta = 0.999$ , the certified accuracy is nearly independent of the perturbation size. Our analysis reveals that when  $\beta$  is low, more structural information is retained on the graph, which benefits the performance of RES under no attack, but also results in more noisy edges being retained on the noisy graph, leading to lower certified accuracy. Conversely, when  $\beta$  is large, less structural information is retained on the graph, which may affect the performance of RES
Figure 3: Ablation Study Results: Comparisons (a) and (b) with FLIP, (c) and (d) with  $\mathrm{RES}_{i\mathbf{S}_j\mathbf{S}}$  under no attack, but also results in fewer noisy edges remaining on the noisy graph, leading to higher certified accuracy for larger perturbation sizes.
To answer Q3, we conduct several ablation studies to investigate the effects of our proposed RES method. More results of ablation studies are shown in Appendix J. We also investigate how hyperparameters  $(1 - \alpha)$  and  $\mu$  affect the performance of our RES, which can be found in Appendix K.
Our first goal is to demonstrate RES is more effective in GCL compared with vanilla binary randomized smoothing in [24]. We implement a variant of our model, FLIP, which replaces the random edgedrop noise with binary random noise [24], thereby flipping the connection status within the graph with the probability  $\beta$ . For our method, we set  $\beta = 0.9$ ,  $1 - \alpha = 99\%$ , and  $\mu = 50$ . For FLIP, to ensure a fair comparison, we set  $\alpha = 99\%$  and  $\mu = 50$ , and vary  $\beta$  over  $\{0.1, 0.2, \dots, 0.9\}$  and select the value which yields the best performance on the validation set of clean graphs. The target GCL method is selected as GRACE. We compare the robust accuracy of the two methods on the clean graph and noisy graph under Nettack with attack budget 3. The average robust accuracy and standard deviation on Cora and Pubmed are reported in Fig. 3 (a) and (b). We observe: (i) RES achieves better results on various graphs (i.e., clean and noisy graph) compared to FLIP and the base GCL method. (ii) FLIP performs much worse than the base GCL method and RES on the clean graph, suggesting that vanilla binary randomized smoothing is ineffective in GCL. That is because FLIP introduces excessive noisy edges, which in turn makes it challenging for GCL to learn accurate representations.
Second goal is to understand how RES contributes to the robustness of GCL. We implement several variants of our model by removing structural information in the training and testing phases, which are named  $\mathrm{RES}_{i\mathbf{S}j\mathbf{S}}$ , where  $i \in \{0,1,2\}$  and  $j \in \{0,1\}$  denote the number of removed structures in the training and testing phases, respectively. For our method, we set  $\beta = 0.9$ ,  $1 - \alpha = 99\%$  and  $\mu = 50$ . We compare the robust accuracy on clean and noisy graphs and use PRBCD to perturb  $10\%$  of the total number of edges in the graph (before attack) for noisy graphs. The overall test set was selected as the target nodes. The results on Cora and OGB-arxiv are shown in Fig. 3 (c) and (d). We observe: (i) Our method significantly outperforms the ablative methods on various graphs, corroborating the effectiveness of randomized edgedrop smoothing for GCL. (ii) Our method and  $\mathrm{RES}_{1\mathbf{S}0\mathbf{S}}$  achieve better robust accuracy on various graphs compared to other ablative methods. This is because dropping edges in only one augmented view during training both alleviates over-fitting and increases the worst-case margin, which is helpful for robustness and model utility. (iii)  $\mathrm{RES}_{2\mathbf{S}j\mathbf{S}}$  and  $\mathrm{RES}_{i\mathbf{S}1\mathbf{S}}$  perform worse than other methods because of the absence of structural information in training and test phases, highlighting the importance of structural information in GCL. Moreover, the ablation studies on the effectiveness of our approach for training the GNN encoder are in Appendix J.1.
In this paper, we present the first work to study the certifiable robustness of GCL. We address the existing ambiguity in quantifying the robustness of GCL to perturbations by introducing a unified definition for robustness in GCL. Our proposed approach, Randomized Edgedrop Smoothing, injects randomized edgedrop noise into graphs to provide certified robustness for GCL on unlabeled data, while minimizing the introduction of spurious edges. Theoretical analysis establishes the provable robust performance of our encoder in downstream tasks. Additionally, we present an effective training method for robust GCL. Extensive empirical evaluations on various real-world datasets show that our method guarantees certifiable robustness and enhances the robustness of any GCL model.
This material is based upon work supported by, or in part by, the National Science Foundation (NSF) under grant number IIS-1909702, the Army Research Office (ARO) under grant number W911NF21-1-0198, and Department of Homeland Security (DNS) CINA under grant number E205949D. The findings in this paper do not necessarily reflect the view of the funding agencies.
[1] Will Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs. Advances in Neural Information Processing Systems, 30, 2017.
[2] Daixin Wang, Jianbin Lin, Peng Cui, Quanhui Jia, Zhen Wang, Yanming Fang, Quan Yu, Jun Zhou, Shuang Yang, and Yuan Qi. A semi-supervised graph attentive network for financial fraud detection. In IEEE International Conference on Data Mining, pages 598-607, 2019.
[3] Yuyang Wang, Jianren Wang, Zhonglin Cao, and Amir Barati Farimani. Molecular contrastive learning of representations via graph neural networks. Nature Machine Intelligence, 4(3):279-287, 2022.
[4] Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In International Conference on Learning Representations, 2017.
[5] Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. How powerful are graph neural networks? In International Conference on Learning Representations, 2018.
[6] Teng Xiao, Zhengyu Chen, Donglin Wang, and Suhang Wang. Learning how to propagate messages in graph neural networks. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pages 1894-1903, 2021.
[7] Yanqiao Zhu, Yichen Xu, Feng Yu, Qiang Liu, Shu Wu, and Liang Wang. Deep Graph Contrastive Representation Learning. In ICML Workshop on Graph Representation Learning and Beyond, 2020.
[8] Fan-Yun Sun, Jordan Hoffman, Vikas Verma, and Jian Tang. Infograph: Unsupervised and semi-supervised graph-level representation learning via mutual information maximization. In International Conference on Learning Representations, 2020.
[9] Yuning You, Tianlong Chen, Yongduo Sui, Ting Chen, Zhangyang Wang, and Yang Shen. Graph contrastive learning with augmentations. In Advances in Neural Information Processing Systems, pages 5812-5823, 2020.
[10] Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. Adversarial attack on graph structured data. International Conference on Machine Learning, 2018.
[11] Daniel Zügner, Amir Akbarnejad, and Stephan Gunnemann. Adversarial attacks on neural networks for graph data. In the ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 2847-2856, 2018.
[12] Kaidi Xu, Hongge Chen, Sijia Liu, Pin-Yu Chen, Tsui-Wei Weng, Mingyi Hong, and Xue Lin. Topology attack and defense for graph neural networks: An optimization perspective. In *IJCAI*, pages 3961–3967, 2019.
[13] Binghui Wang, Tianxiang Zhou, Minhua Lin, Pan Zhou, Ang Li, Meng Pang, Cai Fu, Hai Li, and Yiran Chen. Evasion attacks to graph neural networks via influence function. arXiv preprint arXiv:2009.00203, 2020.
[14] Nikola Jovanovic, Zhao Meng, Lukas Faber, and Roger Wattenhofer. Towards robust graph contrastive learning. arXiv preprint arXiv:2102.13085, 2021.
[15] Shengyu Feng, Baoyu Jing, Yada Zhu, and Hanghang Tong. Adversarial graph contrastive learning with information regularization. In Proceedings of The Web Conference, pages 1362-1371, 2022.
A Details of Related Works
A.1 Graph Contrastive Learning