SlowGuess/NeurIPS_2023_OCR huggingface dataset:
where  $l$  is logistic loss  $l(\mathbf{v}) = \log \left(1 + \sum_{i=1}^{n} \exp(-\mathbf{v}_i)\right)$  according to [57, 39]. Note that this loss is essentially equivalent to the InfoNCE loss [42, 57] shown in Eq. 1, which is widely-used for GCL.
Supervised Loss Linear evaluation, which learns a downstream linear layer after the base encoder, is a common way to evaluate the performance of GCL model in downstream tasks. Let  $\mathcal{C}$  be denoted as the set of latent classes, where  $|\mathcal{C}| = m$ . We consider the standard supervised learning tasks that classify a data point into one of the classes in  $\mathcal{C}$ . To connect the GCL task with the downstream classification task, the supervised loss of downstream classifier  $f$  at  $(\mathbf{x},y)$  is defined as:
$$
L _ {s u p} (\mathbf {x}, y; f) := \ell \left(\left\{f (x) _ {y} - f (x) _ {y ^ {\prime}} \right\} _ {y ^ {\prime} \neq y}\right), \tag {C.28}
$$
where  $l$  is the same as the loss function used in the unsupervised loss in Eq. (C.27). To evaluate the learned representations on downstream tasks, we typically fix  $h$  and train a linear classifier  $\mathbf{W} \in \mathbb{R}^{m \times d}$  on the top of the encoder  $h$ . Therefore, the supervised loss of  $h$  at  $(\mathbf{x}, y)$  is defined as:
$$
L _ {s u p} (\mathbf {x}, y; h) := \inf  _ {\mathbf {W} \in \mathbb {R} ^ {m \times d}} L _ {s u p} (\mathbf {x}, y; \mathbf {W} h), \tag {C.29}
$$
Lemma 2 (Connection between GCL and Downstream Tasks [39]). Given a input sample  $\mathbf{v}$  with its positive sample  $\mathbf{v}^{+}$  and the set of negative samples  $\mathbf{V}^{-} = \{\mathbf{v}_{1}^{-},\dots,\mathbf{v}_{n}^{-}\}$ .  $\mathcal{C}$  is the set of latent class with distribution  $\eta$ . The latent class of  $\mathbf{v}^{+}$  is denoted as  $c^{+}\in \mathcal{C}$ . Suppose any  $\mathbf{v}^{-}\in \mathbf{V}^{-}$  has the latent class  $c^{-}\in \mathcal{C}$ . Then we have
$$
L _ {u n} (\mathbf {v}; h) \geq (1 - \tau) L _ {s u p} (\mathbf {v}, c ^ {+}; h) + \tau , \tag {C.30}
$$
where  $\tau = \mathbb{E}_{c^{+},c^{-}\sim \eta}\mathbf{1}\{c^{+} = c^{-}\}$ , which indicates the expectation that  $c^{+} = c^{-}$ .
Proof. Based on the definitions of  $L_{un}(\mathbf{v};h)$  and  $L_{sup}(\mathbf{v};h)$  in Eq. (C.27) and Eq. (C.29), we have
$$
\begin{array}{l} L _ {u n} (\mathbf {v}; h) = \underset {c ^ {+}, c ^ {-} \sim \eta^ {2}} {\mathbb {E}} [ \underset {\mathbf {v} ^ {+} \sim \mathcal {D} _ {c ^ {+}}, \mathbf {v} ^ {-} \sim \mathcal {D} _ {c ^ {-}}} {\mathbb {E}} \ell (h (\mathbf {v}) ^ {\top} (h (\mathbf {v} ^ {+}) - h (\mathbf {v} ^ {-}))) ] \\ \geq \underset {c ^ {+}, c ^ {-} \sim \eta^ {2}} {\mathbb {E}} \ell \left(h (\mathbf {v}) ^ {\top} \left(\underset {\mathbf {v} ^ {+} \sim \mathcal {D} _ {c ^ {+}}} {\mathbb {E}} [ h (\mathbf {v} ^ {+}) ] - \underset {\mathbf {v} ^ {-} \sim \mathcal {D} _ {c ^ {-}}} {\mathbb {E}} [ h (\mathbf {v} ^ {-}) ]\right)\right) \tag {C.31} \\ = (1 - \tau) _ {c ^ {+}, c ^ {-} \sim \eta^ {2}} \mathbb {E} [ L _ {s u p} (\mathbf {v}, c ^ {+}; f) | c ^ {+} \neq c ^ {-} ] + \tau \\ = (1 - \tau) L _ {s u p} (\mathbf {v}, c ^ {+}; h) + \tau . \\ \end{array}
$$
This completes proof.
Note that the above bound is similar to Lemma 4.3 in [39]. By leveraging our Theorem 2, we can establish the connection between GCL and downstream tasks, and use this connection to prove the transferability of the certified robustness of GCL to downstream tasks.
Theorem 3. Given a GNN encoder  $h$  trained via GCL and an clean input  $\mathbf{v}$ ,  $\mathbf{v}^{+}$  and  $\mathbf{V}^{-} = \{\mathbf{v}_{1}^{-},\dots ,\mathbf{v}_{n}^{-}\}$  are the positive sample and the set of negative samples of  $\mathbf{v}$ , respectively. Let  $c^{+}$  and  $c_{i}^{-}$  denote the latent classes of  $\mathbf{v}^{+}$  and  $\mathbf{v}_{i}^{-}$ , respectively. Suppose  $f$  is the downstream classifier that classify a data point into one of the classes in  $\mathcal{C}$ . Then, we have
$$
\mathbb {P} (f (h (\mathbf {v})) = c ^ {+}) > \max  _ {\mathbf {v} _ {i} ^ {-} \in \mathbf {V} ^ {-}} \mathbb {P} (f (h (\mathbf {v})) = c _ {i} ^ {-}) \tag {C.32}
$$
Proof. Since  $\mathbf{v}$  is a clean input, according to Eq. (C.4) and Sec. 4.1, the positive pair  $(\mathbf{v},\mathbf{v}^{+})$  a pair of similar data that come from the same class distribution  $\mathcal{D}_{c^+}$  and they have the following relationship:
$$
\mathbb {P} (\mathbf {v} \in \mathbb {B} (\mathbf {v} ^ {+}); h) > \max  _ {i} \mathbb {P} (\mathbf {v} \in \mathbb {B} (\mathbf {v} _ {i} ^ {-}); h). \tag {C.33}
$$
Then, based on Theorem 1, we know that  $\mathbb{P}(\mathbf{v}\in \mathbb{B}(\mathbf{v}^{+});h)$  is monotonically increasing as  $s(h(\mathbf{v}),h(\mathbf{v}^{+}))$  increases. Therefore, we have
$$
s \left(h (\mathbf {v}), h \left(\mathbf {v} ^ {+}\right)\right) > \max  _ {i} s \left(h (\mathbf {v}), h \left(\mathbf {v} _ {i} ^ {-}\right)\right) \tag {C.34}
$$
According to Eq. (C.34), we can obtain that:
$$
\sum_ {i = 1} ^ {n} \left[ s \left(h (\mathbf {v}), h \left(\mathbf {v} ^ {+}\right)\right) - s \left(h (\mathbf {v}), h \left(\mathbf {v} _ {i} ^ {-}\right)\right) \right] > 0, \tag {C.35}
$$
and the equivalent form of Eq. (C.35) is given as:
$$
\left(\tilde {s} \left(h \left(\mathbf {v} ^ {+}\right)\right) - \tilde {s} \left(h \left(\mathbf {v} ^ {-}\right)\right)\right) ^ {\top} h (\mathbf {v}) > 0, \forall \mathbf {v} ^ {-} \in \left\{\mathbf {v} _ {1} ^ {-}, \dots , \mathbf {v} _ {n} ^ {-} \right\}, \tag {C.36}
$$
where  $\tilde{s}$  is the  $l_{2}$ -normalization operation on vector  $\mathbf{v}$ . Then, we can obtain:
$$
\left(\tilde {s} \left(h \left(\mathbf {v} ^ {+}\right)\right) - \tilde {s} \left(h \left(\mathbf {v} ^ {-}\right)\right)\right) ^ {\top} \tilde {s} \left(h (\mathbf {v})\right) > 0, \forall \mathbf {v} ^ {-} \in \left\{\mathbf {v} _ {1} ^ {-}, \dots , \mathbf {v} _ {n} ^ {-} \right\}. \tag {C.37}
$$
To relate the robustness of GCL to that of downstream tasks, we select the negative samples whose latent class  $c_{i}^{-}$  is different from  $c^{+}$  and obtain the following relationship:
$$
\sum_ {i = 1} ^ {n} \left[ \left(\tilde {s} \left(h \left(\mathbf {v} ^ {+}\right)\right) - \tilde {s} \left(h \left(\mathbf {v} ^ {-}\right)\right)\right) ^ {\top} \tilde {s} \left(h (\mathbf {v})\right) \mid c ^ {+} \neq c _ {i} ^ {-} \right] > 0. \tag {C.38}
$$
Substitute the left side of Eq. (C.38) into Eq (C.27), we have  $L_{un}(\mathbf{v};h) < 1$ . According to Lemma 2, we know that:
$$
L _ {s u p} (\mathbf {v}, c ^ {+}; h) \leq \frac {L _ {u n} (\mathbf {v} ; h) - \tau}{1 - \tau} <   1. \tag {C.39}
$$
Hence, according to the definition of  $L_{sup}$  in Eq. (C.29), we have:
$$
\mathbb {P} \left(f (h (\mathbf {v})) = c ^ {+}\right) > \mathbb {P} \left(f (h (\mathbf {v})) = c ^ {-}\right), \forall c ^ {-} \in \left\{c _ {1} ^ {-}, \dots , c _ {n} ^ {-} \right\} \tag {C.40}
$$
which means that the logit output of the positive latent class  $c^+$  is always larger than any negative latent class  $c_i^-$  for  $\mathbf{v}$ . Thus, we can rewrite Eq. (C.40) to Eq. (C.32), and conclude the proof.
Algorithm 1 The Training Algorithm of RES.
Output: Trained GNN encoder  $h_{\theta}$ .
1: Randomly initialize  $\theta$  for  $h_\theta$ ;
Input:  $\mathcal{G} = (\mathcal{V},\mathcal{E},\mathbf{X})$
2: for epoch  $= 1,2,\dots$  , do
3: Generate two augmented graphs  $\mathcal{G}_i$  and  $\mathcal{G}_j$  by  $q_i(\mathcal{G})\sim \mathcal{T}$  and  $q_{j}(\mathcal{G})\sim \mathcal{T}$
4:Inject randomized edgedrop noise  $\epsilon$  to  $\mathcal{G}_i$
5: Obtain node or graph representation  $\mathbf{Z}_i$  and  $\mathbf{Z}_j$  from  $\mathcal{G}_i$  and  $\mathcal{G}_j$  by using  $h_\theta$ ;
6: Update  $\theta$  by applying gradient descent to minimize Eq. (1).
8: return  $h_{\theta}$ ;
By applying Theorem 3, we can demonstrate that given  $\mathbf{v}$ 's perturbed version  $\mathbf{v}' = \mathbf{v} \oplus \delta$ , where  $||\delta||_0 \leq k$ , if  $\mathbf{v}$  and  $\mathbf{v}'$  satisfy Eq. (8) and Eq. (9) in Theorem 2, we have
$$
\mathbb {P} \left(f \left(h \left(\mathbf {v} ^ {\prime} \oplus \epsilon\right)\right) = c ^ {+}\right) > \max  _ {\mathbf {v} _ {i} ^ {-} \in \mathbf {V} ^ {-}} \mathbb {P} \left(f \left(h \left(\mathbf {v} ^ {\prime} \oplus \epsilon\right)\right) = c _ {i} ^ {-}\right), \forall \| \delta \| _ {0} \leq k, \tag {C.41}
$$
which implies provable  $l_0^k$ -certified robustness retention of  $h$  at  $(\mathbf{v}, c^+)$  in downstream tasks. The proof is completed.
D Training Algorithms
We summarize the training method of Sec. 5.1 for training smoothed GNN encoders in Algorithm 1. Specifically, at each training epoch, we first generate two augmented graphs  $\mathcal{G}_i$  and  $\mathcal{G}_j$  via  $q_i(\mathcal{G})$  and  $q_j(\mathcal{G})$ , respectively, where  $q_i(\mathcal{G})$  and  $q_j(\mathcal{G})$  are two graph augmentations sampled from an augmentation pool  $\mathcal{T}$ . The graph augmentation includes edge perturbation, feature masking, node dropping, etc. (line 3). Then we inject randomized edgedrop noise  $\epsilon$  to one of the augmented graphs  $\mathcal{G}_i$  (line 4). From line 5 to line 10, we train the GNN encoder  $h_\theta$  through GCL by maximizing the agreement of representations in these two views. In detail, we apply  $h_\theta$  to obtain node or graph representations  $\mathbf{Z}_i$  and  $\mathbf{Z}_j$  from  $\mathcal{G}_i$  and  $\mathcal{G}_j$ , respectively (line 5), then we do gradient descent on  $\theta$  based on Eq. (1).
E Discussions
E.1 Difference between RES and Edge-dropping Augmentations in [9] and [58]
Our RES is inherently different from the random edge-dropping augmentation in GraphCL [9] and the learnable edge-dropping augmentation in ADGCL [58]: (i) Random edge-dropping is an augmentation method to generate different augmented views and maximize the agreement between views, and the learnable edge-dropping [58] is also an augmentation method to enhance downstream task performance. However, RES is devised from the robustness perspective, providing certifiable robustness and enhancing the robustness of any GCL method. (ii) While random edge-dropping and learnable edge-dropping are only applied to augment graphs for GCL, RES extends beyond this. Following the generation of two augmented views as shown in Sec. 5.1, RES injects randomized edgedrop noise into one augmented view during GCL training. Then, it performs randomized edgedrop smoothing in the inference phase through Monte Carlo, as shown in Sec. 5.2. Specifically, for inference using RES,  $\mu$  samples of  $h(\mathbf{v} \oplus \epsilon)$  are drawn by injecting randomized edge-drop noise  $\epsilon$  to  $\mathbf{v} \mu$  times. The final prediction is from Monte Carlo, selecting the  $\mu$  predictions with the highest frequency in  $\mu$  samples.
To demonstrate the effectiveness of RES, we further compare ADGCL with RES-GraphCL on MUTAG and PROTEINS. We also add RES-ADGCL into comparisons. More details are shown in Appendix. I.4.
E.2 Additional Details of Concatenation Vector
The concatenation vector  $\mathbf{v}$  is a vector to depict the structure of the node/graph for learning representations. For node-level tasks, it represents the connection status of any pair of nodes in the K-hop
subgraph of the node  $v$ . For graph-level tasks, it represents the connection status of any pair of nodes in the graph  $\mathcal{G}$ . To construct such a vector, we select the upper triangular part of the adjacency matrix of the K-hop subgraph of  $v$  or the graph  $\mathcal{G}$  and flatten it into the vector, where each item in this vector can denote the connection status of any pair of nodes in the K-hop subgraph of the node  $v$  or the graph  $\mathcal{G}$ .
The motivation for using this notation is that since we focus on perturbations on the graph structure  $\mathbf{A}$  in this paper, we treat the feature vector of  $v$  as a constant and use the adjacency matrix of the K-hop subgraph of the node or the adjacency matrix of the graph to represent the structure of the node or graph. For simplicity and clarity, given a GNN encoder  $h$  and the concatenation vector  $\mathbf{v}$  of the node  $v$  or the graph  $\mathcal{G}$  as above, we then omit the node feature matrix  $\mathbf{X}$  and simply write the node  $v$ 's representation  $h_v(A,X)$  and the graph  $\mathcal{G}$ 's representation  $h(\mathcal{G})$  as  $h(\mathbf{v})$ . Therefore, we use a unified notation  $\mathbf{v}$  to denote the node  $v$  or the graph  $\mathcal{G}$ , and further facilitate our theoretical derivations.
E.3 Definition of Well-trained GNN encoders
The well-trained GNN encoder is defined as an encoder that can extract meaningful and discriminative representations by mapping the positive pairs closer in the latent space while pushing dissimilar samples away.
To evaluate whether a GNN encoder  $h$  is well trained or not mathematically, we introduce criteria based on the similarity between node/graph representations in the latent space. For each positive pair  $(\mathbf{v},\mathbf{v}^{+})$  with its negative samples  $\mathbf{V}^{-} = \{\mathbf{v}_{1},\dots ,\mathbf{v}_{n}\}$ , we clarify that  $h$  is well-trained at  $(\mathbf{v},\mathbf{v}^{+})$  if the following inequality is satisfied:
$$
s \left(h (\mathbf {v}), h \left(\mathbf {v} ^ {+}\right)\right) > \max  _ {\mathbf {v} ^ {-} \in \mathbf {V} ^ {-}} s \left(h (\mathbf {v}), h \left(\mathbf {v} ^ {-}\right)\right), \tag {E.42}
$$
where  $s(\cdot, \cdot)$  is a cosine similarity function. This implies that  $h$  can effectively discriminate  $\mathbf{v}$  from all its negative samples in  $\mathbf{V}^{-}$  and learn the meaningful representations for  $\mathbf{v}$  in the latent space. Therefore, based on Eq. (E.42), we can further extend the criteria for certifying robustness in GCL, which is shown in Definition 2.
E.4 Rationale behind Setting High Values for  $\beta$
The proposed robust encoder training method in Sec. 5.1 improves the model utility of GCL. Even setting a large  $\beta$  for RES, we can still obtain high robust accuracy on clean graphs, further leading to high certified accuracies.
Specifically, as shown in Sec. 6.1, certified accuracy denotes the fraction of correctly predicted test nodes/graphs whose certified perturbation size is not smaller than the given perturbation size. It implies that these certified robust samples should also be correctly predicted by RES in the clean datasets. However, as the reviewer said, introducing randomized edgedrop solely to test samples during the inference could potentially hurt downstream task performance and further negatively impact the certified robustness based on Eq.(8). Thus, we propose robust encoder training for RES in Sec. 5.1 by injecting randomized edgedrop noise into one augmented view during GCL. It ensures the samples with randomized edgedrop noises align in latent class with clean samples under the encoder, thereby mitigating the negative impacts of such noises and further benefiting the robustness and certification of RES.
F Code
Our code is available at https://github.com/ventr1c/RES-GCL.
G Additional Details of Experiment Settings
G.1 Dataset Statistics
For node classification, we conduct experiments on 4 public benchmark datasets: Cora, Pubmed [47], Amazon-Computers [48] and OGB-arxiv [49], Cora and Pubmed are small citation networks. Amazon-Computers is a network of goods represented as nodes, and edges between nodes represent
that the two goods are frequently bought together. OGB-arxiv is a large-scale citation network. For graph classification, we use 3 well-known dataset: MUTAG, PROTEINS [50] and OGB-molhiv [49]. MUTAG is a collection of nitroaromatic compounds. PROTEINS is a set of proteins that are classified as enzymes or non-enzymes. OGB-molhiv is a dataset contains molecules, which is adopted from MoleculeNet [59]. Among these datasets, for Cora and Pubmed, we evaluate the models on the public splits. Regarding to the other 5 datasets, Coauthor-Physics, OGB-arxiv, MUTAG, PROTEINS and OGB-molhiv, we instead randomly select  $10\%$ ,  $10\%$ , and  $80\%$  nodes/graphs for the training, validation and test, respectively. The statistics details of these datasets are summarized in Table 2.
Table 2: Dataset Statistics
Datasets	#Graphs	#Avg. Nodes	#Avg. Edges	#Avg. Feature	#Classes
Cora	1	2,708	5,429	1,443	7
Pubmed	1	19,717	44,338	500	3
Coauthor-Physics	1	34,493	495,924	8415	5
OGB-arxiv	1	169,343	1,166,243	128	40
MUTAG	188	17.9	39.6	7	2
PROTEINS	1,113	39.1	145.6	3	2
OGB-molhiv	41,127	25.5	27.5	9	2
G.2 Attack Methods
One of our goals is to show RES is robust to various structural noises, we evaluate RES on 4 types of structural attacks in evasion setting, i.e., Random attack, Nettack [11], PRBCD [51], CLGA [16] for both node and graph classification. The procedure of the evasion attack against GCL in transductive node classification is shown in Algorithm 2. The details of these attacks are described following:
1. Random Attack: We randomly add some noisy edges to the graphs for node classification and graph classification, respectively, until the attack budget is satisfied. Specifically, we consider two kinds of attack settings for node classification, that is, global random attack and targeted random attack. For global random attack, which is used in Sec. 6.2, we randomly inject some fake edges (10% in our setting) into the whole graph. For targeted attack, we randomly connect some fake edges to the direct neighbors of target nodes.
2. Nettack [11]: It is a targeted attacks for node classification that manipulate the graph structure to mislead the prediction of target nodes.
3. PRBCD [51]: It is a scalable global attack for node classification that aims to decrease the overall accuracy of the graph.
4. CLGA [16]: It is an unsupervised gradient-based poisoning attack targeting graph contrastive learning for node classification. Since we focus on evasion attacks, we directly use the poisoned graph generated by CLGA in the downstream tasks to evaluate the performance and regard it as an evasion global attack.
Moreover, we further consider two graph injection attack methods, i.e., TDGIA [60] and AGIA [61], as baselines to demonstrate the robustness of RES. The details of experimental results are shown in Sec. I.3.
G.3 Compared Methods
We select four state-of-the-art GCL methods and employ RES on them to train smoothed GNN encoders:
1. GRACE [30]: It is node-level GCL method which creates multiple augmented views by perturbing graph structure and masking node features. Then it encourages consistency between the same nodes in different views.
2. BGRL [52]:Inspired by BYOL [62], it is performs graph contrastive learning that does not require negative samples. Specifically, it applies two graph encoders (i.e., online and targeted encoders), and update them iteratively to make the predicted representations closer to the true representations for each node.
Algorithm 2 The Evasion Attack Procedure against GCL in Transductive Node Classification
Input: Clean graph  $\mathcal{G} = (\mathcal{V},\mathcal{E},\mathbf{X})$  , GNN encoder  $h_\theta$  , target node  $v$  with class label  $c$  , perturbation  $\delta$  , downstream classifier  $f$    
Output: success (i.e., attack  $v$  successfully or not) 1: Train  $h_\theta$  on  $\mathcal{G}$  via GCL; 2: Obtain perturbed node  $v^{\prime}$  by adding perturbation  $\delta$  to  $v$  . 3: Generate the representation of  $v^{\prime}$  as  $h(v^{\prime})$  . 4: if  $f(h(v^{\prime})) = c$  then 5: return success  $\leftarrow$  false; 6: else 7: return success  $\leftarrow$  true; 8: end if
3. DGI [31]: It is a state-of-the-art GCL method which adapted from Deep InfoMax [63] to maximize the mutual information between local and global features.
4. GraphCL [9]: It is the first work to study GCL at graph-level. Specifically, it constructs four types of graph augmentations and adapts SimCLR [55] to learn graph-level embeddings.
Moreover, we also compare RES-GCL with several representative and state-of-the-art graph representation learning methods and robust GCLs against structural noises:
1. Node2Vec [53]: It is a traditional unsupervised methods. Its key idea is to perform random walks on the graph to generate sequences of nodes that capture both the local and global structure of the graph.
2. GAE [54]: It is a representative unsupervised learning method which learns a low-dimensional representation of a graph by encoding its nodes and edges into a vector space, and then decoding this representation back into a graph structure. It is trained to minimize the reconstruction error between the original graph and the reconstructed graph.
3. GCL-Jaccard: It is implemented by removing dissimilar edges based on Jaccard similarity before and after the training phase, respectively, which is inspired from GCN-Jaccard [64].
4. Ariel [15]: It is a robust GCL method which uses an additional adversarial graph view in graph contrastive learning to improve the robustness. An information regularizer is also applied to stabilize its performance.
G.4 Implementation details
A 2-layer GCN is employed as the backbone GNN encoder and a common used linear evaluation scheme [31] is adopt in the downstream tasks. More specifically, each GNN encoder is firstly trained via GCL method and then the resulting embeddings are used to train and test a  $l_{2}$ -regularized logistic regression classifier. GRACE is implemented based on the source code published by authors<sup>1</sup>. BGRL and DGI methods are implemented based on PyGCL library [65]. All hyperparameters of all methods are tuned based on the validation set for fair comparison. All models are trained on an A6000 GPU with 48G memory.
G.5 Attack Settings
In this paper, we assume that the attacker can conduct attack in two settings: transductive node classification and inductive graph classification. These two settings are described below:
- Transductive Setting: In this setting, test instances (nodes/graphs) are visible during both training the GNN encoder and inference in downstream tasks. Specifically, we first train a GNN encoder  $h$  via GCL on a clean dataset that includes test nodes to generate node representations. Then, an attacker adds perturbations to the test nodes, causing  $h$  to produce poor representations that degrade performance on downstream tasks. For example, an attacker may attempt to manipulate a social network by injecting fake edges, which could affect the performance of
$^{1}$ https://github.com/CRIPAC-DIG/GRACE
a well-trained  $h$  in tasks such as community detection, influential node identification, or link prediction.
- Inductive Setting: In this setting, test instances only appear in downstream tasks and are invisible during the training phase. This setting is similar to the transductive setting, but the test nodes/graphs are not seen during training. This scenario commonly arises in real-world applications such as new drug discovery, where an attacker may attempt to manipulate a new molecular graph in the test set to mislead the model, resulting in incorrect predictions in downstream tasks.
H Additional Results of the Performance of Certificates
In this section, we extend the experiments in Sec. 6.3 and present comprehensive results on the performance of robustness certificates. Our aim is to demonstrate that RES can effectively provide certifiable robustness for various GCL methods. We select GRACE, BGRL, DGI, and GraphCL as the target GCL methods and integrate them with RES. We perform experiments on Cora, Pubmed, Coauthor-Physics, and OGB-arxiv for node classification tasks, as well as MUTAG, PROTEINS, and OGB-molhiv for graph classification tasks. Certified accuracy is selected as the evaluation metric. Specifically, certified accuracy [46, 24] denotes the fraction of correctly predicted test nodes/graphs whose certified perturbation size is no smaller than the given perturbation size. The complete results are reported in Fig. 4 to Fig. 8.
(a) GRACE
(b) BGRL
(c) DGI
Figure 4: Certified accuracy of RES-GCL on Cora
(b) BGRL
Figure 5: Certified accuracy of RES-GCL on Pubmed
(a) GRACE
(c) DGI
Figure 6: Certified accuracy of RES-GCL on Coauthor-Physics
I Additional Results of the Performance of Robustness