SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Table 4: The statistics of the four datasets.
Dataset	avg nodes	avg edges	split
BA-3Motifs	21.92	14.76	2200/400/400
Mutag	30.32	30.77	3337/500/500
Ogbg-molhiv	25.5	27.5	scaffold split [40]
Ogbg-ppa	243.4	2266.1	scaffold split [40]
D.3 Baseline
We next briefly introduce the baseline explainers used in our experiments, including the gradients-based, the perturbation-based, and the surrogate GNN explanation methods.
- GradCAM [21] is a gradients-based explanation method. It conducts a weighted summation on the last layer representation to obtain the significance scores. The weights are provided by gradient back-propagation.
- IG [22] is a gradients-based explanation method. It calculates the significance scores by conducting path integral of the input feature gradients.
- GNNExplainer [15] is a perturbation-based explanation method. It perturbs both the topological structure and the node features to calculate the significance scores and search for explanation subgraphs  $G_{S}$  that maximize the mutual information between  $G_{S}$  and full graph prediction  $\hat{y}$ .
- PGExplainer [13] is a perturbation-based explanation method. It perturbs the topology and employs a parametric neural network to calculate the significance scores, with the same objective function in GNNExplainer.
- ReFine [36] is a perturbation-based explanation method. It applies the pre-training and fine-tuning paradigm to the GNN explanation exploration problem, which promises to offer an all-round inspection of the GNN decision-making process from multi-granularity.
- PGM-Explainer [37] is a surrogate explanation method. It trains an interpretable Bayesian network to fit the predicted label of the GNN model.
D.4 Base GNN model
The architectures and downstream task performances of the base GNN models which function as the third-party predictors in our experiments are reported in Table 5.
Table 5: The architectures and downstream task performances of the base GNN models.
Dataset	Backbone	Layers	Test Acc
BA-3Motifs	LEconv [41]	2	100.00
Mutag	GINConv [42]	2	83.63
Ogbg-molhiv	GCNConv [43]	5	98.13
Ogbg-ppa	GCNConv	5	60.46
In the ablation study, we create three variants of the full V-InfoR. No-VAE removes the robust graph information extractor, which explores explanations based on the latent representations from the GNN model to be explained. No-GIB replaces the GIB-based optimization objective function with the traditional sparsity-driven mutual information objective function. No-VAE-GIB drops both two proposed modules. We report the performance of full V-InfoR and three variants in Figure 6.
It shows that the performance drops significantly when removing either the robust graph representation extractor or the adaptive graph information constraint. The performance of No-VAE-GIB is the lowest among the variants. As shown in Figure 6, the performance of No-GIB degrades more significantly than No-VAE in all the cases. This implies that the severe corruptions can more significantly affect the GNN explainers than the minor corruptions, which is consistent with the preliminary result in Section 2.1. On the one hand, the improvements from No-VAE-GIB to No-GIB and No-VAE indicate that both of the two modules are helpful to explain the corrupted graphs. On the other hand, the inferiority of No-GIB and No-VAE to the full V-InfoR further reveals that merely adopting one of the two modules is unable to deal with the graphs with two types of structural corruptions.
F Case Study
We give a visualized case study of explanations provided by V-InfoR and five baselines for the BA-3Motifs. Figure 7(a) shows the three types of motifs: cycle, grid, and house. Figure 7(b) shows the explanations on a graph with minor corruptions, whose prediction (cycle class) and ground-truth explanation (cycle) are both unchanged. V-InfoR allocates high significance scores (marked by red lines) to the cycle motif (highlighted by circle) correctly and eliminates the minor corruption successfully. While the other baseline explainers pay little attention to the vital cycle motif and fail to identify it as the explanation. Figure 7(c) shows the explanations of the severely corrupted graph. The raw prediction and raw ground-truth explanation are both associated with the grid motifs (marked by "before corrupted"), which have been broken by the severe corruption. Since the severe corruption has changed the prediction to house class, the explanation should be the house motif (marked by "after corrupted"). However, the five baseline explainers still allocate high significance scores to the component of the grid motif. Only V-InfoR succeeds in identifying the house motif (highlighted by circle) as the explanation.
Figure 6: The ablation study of V-InfoR and three variants.
Figure 7: A case study of explanations provided by V-infoR and five baseline explainers.
G Robustness Evaluation
To directly demonstrate the robustness of our proposed V-InfoR, we introduce a robustness evaluation metric [44, 45], which is defined as the performance drop after a certain ratio of noise/adversarial attack is added into the graphs. A smaller performance drop means a more robust model and a negative value indicates that the model can even perform better under noise/adversarial attack.
First, we report the performance drop of V-InfoR and all the baselines in Table 6, with GRABNEL attack ratio set as  $\{2.5\%, 5.0\%, 7.5\%, 10\% \}$ . The results show that our proposed method can even improve the explanation performance on Mutag dataset after adversarial attack, while the performance of all the baselines degrade, which can demonstrate the robustness of our model to GRABNEL attack.
As shown in Table 7, we further report the performance drop of V-InfoR and all the baselines with the random noise ratio set as  $\{0.05, 0.10, 0.15, 0.20, 0.25, 0.30\}$ . For the Ogbg-molhiv and Ogbg-ppa, V-InfoR is more robust to the random noise than all the baselines. The result on Mutag indicates that V-InfoR stands among the top-tier robust methods, since the irregularity in chemical molecules is more obvious and significant. This phenomenon implies that our method relies more on capturing the irregularity stemming from graph corruption in order to maintain its robustness. When adding adversarial attack to Mutag graphs, the robustness of our method is more significant, which
Table 6: The robustness evaluation with GRABNEL attack.
Dataset	Ratio	GradCAM	IG	GNNExplainer	PGExplainer	PGM-Explainer	ReFine	V-InfoR	Rank
Mutag	2.5%	0.0159	0.0190	0.0068	0.0056	0.0374	0.0092	-0.0054	1
5.0%	0.0038	0.0194	0.0287	-0.0047	0.0245	0.0093	-0.0186	1
7.5%	0.0052	0.0286	0.0690	-0.0032	0.0496	0.0274	-0.0172	1
10.0%	0.0027	0.0420	0.0593	0.0035	0.0637	0.0200	-0.0147	1
BA-3Motifs	2.5%	0.0459	0.0141	0.0085	0.0157	0.0521	0.0504	-0.0047	1
5.0%	0.0668	0.0400	0.0554	0.0509	0.0557	0.0962	-0.0010	1
7.5%	0.2526	0.1926	0.0505	0.0700	0.1811	0.0996	0.0241	1
10.0%	0.3947	0.2608	0.1352	0.0859	0.2174	0.2521	0.1277	2
Table 7: The robustness evaluation with random noise.
Dataset	Ratio	GradCAM	IG	GNNExplainer	PGExplainer	PGM-Explainer	ReFine	V-InfoR	Rank
Ogbg-molhiv	0.05	0.0154	0.0741	0.0297	0.0247	0.0963	0.0318	0.0054	1
0.10	0.0766	0.1469	0.0495	0.0577	0.0591	0.0554	0.0073	1
0.15	0.0997	0.1914	0.0658	0.0569	0.0940	0.0605	0.0156	1
0.20	0.1674	0.2132	0.1063	0.0518	0.1298	0.1325	0.0496	1
0.25	0.2149	0.1606	0.1237	0.1237	0.1556	0.1692	0.0630	1
0.30	0.2314	0.1775	0.1469	0.1593	0.1397	0.1890	0.0858	1
Ogbg-ppa	0.05	0.0045	0.0153	0.0063	0.0228	0.0537	0.0075	0.0013	1
0.10	0.0506	0.0381	0.0402	0.1014	0.0789	0.0404	0.0172	1
0.15	0.0797	0.0403	0.0535	0.1421	0.1331	0.0648	0.0237	1
0.20	0.1010	0.0639	0.0844	0.2069	0.1049	0.0859	0.0328	1
0.25	0.1357	0.1053	0.1093	0.2224	0.1591	0.1556	0.0254	1
0.30	0.1797	0.0958	0.1267	0.2391	0.1656	0.1577	0.0491	1
Mutag	0.05	0.0866	0.0849	0.1037	0.0711	0.1131	0.0781	0.0647	1
0.10	0.1669	0.1738	0.1532	0.1565	0.1986	0.1681	0.1189	1
0.15	0.2656	0.2430	0.2348	0.2099	0.2647	0.2431	0.2097	1
0.20	0.3218	0.3081	0.3023	0.2800	0.2794	0.2866	0.2403	1
0.25	0.3417	0.3435	0.3343	0.3103	0.3359	0.3242	0.3118	2
0.30	0.3655	0.3775	0.3819	0.3428	0.3690	0.3670	0.3452	2
BA-3Motifs	0.05	-0.0074	0.0074	0.0020	-0.0137	0.0150	0.0231	0.0061	4
0.10	-0.0041	0.0239	0.0019	0.0400	0.0353	0.0238	0.0163	3
0.15	0.0825	0.0801	0.0493	0.0672	0.1043	0.0884	0.0878	5
0.20	0.1125	0.1772	0.1358	0.1402	0.1874	0.1923	0.1527	4
0.25	0.1278	0.2112	0.1574	0.1615	0.2100	0.2071	0.1836	4
0.30	0.1407	0.2169	0.1617	0.1879	0.1952	0.2285	0.1951	4
verifies our deduction again. For BA-3Motifs, the result shows that our proposed model is within the middle range of the robustness evaluation on BA-3Motifs graphs with random noise. This can be attributed to two main possible reasons. Firstly, the introduction of random noise results in a lesser degree of irregularity compared to adversarial attack and thus the ability of our method to capture irregularities in corrupted graphs does not bring robustness improvement significantly. In contrast, our method showcases greater robustness than the baseline models when exposed to adversarial attacks on BA-3Motifs graphs. This is due to the fact that such attacks will destroy the influential motifs and consequently amplify the level of irregularity. Secondly, the synthetic BA-3Motifs graph itself adheres to a more regular structure than real-world graphs, which adopts a Barabasi-Albert graph as the base and attaches the base with one of three motifs. Consequently, the potential for our method to achieve robustness improvement is further constrained by the synthetic structural topology.
H Limitation
Node Feature Corruptions. Both the robust graph representation extractor and the adaptive explanation generator are proposed to mitigate and address the graph structural corruptions. Thus, V-InfoR cannot be directly applied to explain the graphs with node feature corruptions. In the future work, we will extend the V-InfoR model to fulfill the robustness on node feature level.
Multi-Task Explanation. The explanation performance of V-InfoR explainer on some other graph tasks, such as node classification and link prediction tasks, has not been evaluated. We argue that V-InfoR can be directly used to explain the GNN predictor on node classification task, with little modification. However, the V-InfoR explainer for link prediction is non-trivial, since the GNN explanation methods on link prediction is scarce until now.