Year: 2021

Abstract:
A lot of theoretical and empirical evidence shows that the flatter local minima tend to improve generalization. As an emerging technique to efficiently and effectively find such minima, Adversarial Weight Perturbation (AWP) minimizes the loss w.r.t. a bounded worst-case perturbation of the model parameters by (approximately) solving an associated min-max problem, i.e. favoring local minima with a small loss in a neighborhood around them. The benefits of AWP, and more generally the connections between flatness and generalization, have been extensively studied for i.i.d. data such as images. In this paper, we initiate the first study of this phenomenon for non-i.i.d. graph data. Along the way, we first derive a generalization bound for non-i.i.d. graph classification tasks, then we identify a vanishinggradient issue with all existing formulations of AWP and we propose new Weighted Truncated AWP (WT-AWP) to alleviate this issue. We show that regularizing graph neural networks with WT-AWP consistently improves both natural and robust generalization across many different graph learning tasks and models.

heading: 1 INTRODUCTION
text: Simply minimizing the standard cross-entropy loss for highly non-convex and non-linear models such as (deep) neural networks is not guaranteed to obtain solutions that generalize well, especially for today’s overparamatrized networks. The key underlying issue is that these models have many different local minima which can have wildly different generalization properties despite having nearly the same performance on training and validation data. Naturally, there is a rich literature that studies the properties of well-behaving local minima, as well as the design choices that improve our chances of finding them (Stutz et al., 2021). The notion of flatness which measure how quickly the loss changes in a neighbourhood around a given local minimum has been empirically shown to correlate with generalization among a variety of different measures (Jiang et al., 2019). In addition, generalization bounds based on the PAC-Bayes framework (McAllester, 1999; Foret et al., 2021) provide theoretical insights that corroborate the mounting empirical data. Since the evidence implies that flatter minima tend to generalize better, the obvious question is how to efficiently find them.
Not only do flat minima improve generalization from the training to the test data, i.e. the clean accuracy (Foret et al., 2021; Zheng et al., 2021; Kwon et al., 2021), but they also improve generalization to adversarial examples, i.e. the robust accuracy (Wu et al., 2020a; Stutz et al., 2021). Improving adversarial robustness is important, especially for models deployed in safety-critical domain or models deployed in the real-world, since most standard (undefended) models are vulnerable to adversarial attacks. Attackers can easily craft deliberate and unnoticeable input perturbations that change the prediction of the classifier. Flat minima show higher resistance to such adversarially perturbed inputs while maintaining good clean accuracy (Stutz et al., 2021).
Among the variety of techniques for finding flat minima Adversarial Weight Perturbation (AWP) (Wu et al., 2020a), and the closely-related (adaptive) sharpness-aware minimization (Foret et al., 2021; Kwon et al., 2021) and adversarial model perturbation (Zheng et al., 2021), seems to be quite effective in practice. The key idea is to minimize the loss w.r.t. a bounded worst-case perturbation of the model parameters, i.e. minimize a local notion of sharpness. The benefits of this approach, and more generally the correlation between flatness and (clean/robust) generalization, have been extensively studied for i.i.d. data such as images. In this paper we study this phenomenon for graph data for the first time. Concretely, we analyze and improve the robustness of Graph Neural Networks (GNNs) which have become a fundamental building block (in addition to CNNs and RNNs).
Blindly applying existing weight perturbation techniques to GNNs is unfortunately not effective in practice due to a vanishing-gradient issue. Intuitively, the adversarially perturbed weights tend to have a higher norm which in turn leads to a saturation in the last layer where that logits for one class are on a significantly larger scale compared to the rest. Even though this limitation plagues all formulations of AWP, for both GNNs and other models (e.g. ResNets), it has gone unnoticed so far. To address it we propose Weighted Truncated Adversarial Weight Perturbation (WT-AWP) where rather than directly minimizing the (robust) AWP loss we use it as a regularizer in addition to the standard cross-entropy loss. Moreover, we propose to abstain from perturbation in the last layer(s) of the network for a more fine-grained control of the training dynamics. These two modifications are simple, but necessary and effective. With our resulting formulation the models can obtain useful gradient signals for training even when the perturbed weights have a high norm, mitigating the gradient-vanishing issue. Furthermore, we theoretically study the AWP learning objective and show its invariance for local extrema. We can summarize our contributions as follows:
• We provide a theoretical analysis of AWP on non-i.i.d. graph data and identify a vanishinggradient issue that plagues all previous AWP variants. Based on this analysis we propose Weighted Truncated Adversarial Weight Perturbation (WT-AWP) that mitigates this issue.
• We study for the first time the connections between flatness and generalization for Graph Neural Networks. We show that GNNs trained with our WT-AWP formulation have simultaneously improved natural and robust generalization. The improvement is statistically significant and consistent across tasks (node-level and graph-level classification) and across models (standard and robustness-aware GNNs). All this at a negligible computational cost.

heading: 2 BACKGROUND AND RELATED WORK
text: Adversarial Weight Perturbation for Images. AWP is motivated by the connection between the flatness of the loss landscape and model generalization. Given a learning objective L(·) and an image classification model with parameters θ, the generalization gap (Wu et al., 2020a), also named the sharpness term (Foret et al., 2021), which measures the worst-case flatness of the loss landscape, is defined by [max||δ||≤ρ L(θ + δ) − L(θ)]. This gap is known to control a PAC-Bayes generalization bound (Neyshabur et al., 2017), with a smaller gap implying better generalization. The AWP objective optimizes the generalization gap and the loss function simultaneously via minθ[(max||δ||≤ρ L(θ + δ)− L(θ)) + L(θ)] = minθ max||δ||≤ρ L(θ + δ). Providing further theoretical justification for the effectiveness of the AWP, Zheng et al. (2021) prove that this objective favors solutions corresponding to flatter local minima assuming that the loss surface can be approximated as an inverted Gaussian surface. Relatedly, they show that AWP penalizes the gradient-norm. Keskar et al. (2016) show that large-batch training may reach sharp minima, however GNNs usually use a small batch size. In some cases we can rescale the weights to achieve arbitrarily sharp minima that also generalize well (Dinh et al., 2017). Investigating this issue for GNNs is out of our scope.
GNNs, Graph attacks, and Graph defenses. Graph Neural Networks (GNNs) are emerging as a fundamental building block. They have achieved spectacular results on a variety of graph learning tasks across many high-impact domains (see survey (Wu et al., 2020b)). Despite their success, it has been demonstrated that GNNs suffer from evasion attacks at test time (Zügner et al., 2018) and poisoning attacks at training time (Zügner and Günnemann, 2019). Meanwhile, a series of methods have been developed to improve their robustness. For example, GCNJaccard (Wu et al., 2019) drops dissimilar edges in the graph, as it found that attackers tend to add edges between nodes with different features. GCNSVD (Entezari et al., 2020) replaces the adjacency matrix with its low-rank approximation motivated by the observation that mostly the high frequency spectrum of the graph is affected by the adversarial perturbations. We also have provable defenses that provide robustness certificates (Bojchevski et al., 2020). Both heuristic defenses (e.g. GCNJaccard and GCNSVD) and certificates are improved with our WT-AWP. For an overview of attacks and defenses see Sun et al. (2018).

heading: 3 ADVERSARIAL WEIGHT PERTURBATION ON GRAPH NEURAL NETWORKS
text: To simplify the exposition we focus on the semi-supervised node classification task. Nonetheless, in Sec. 5.8 we show that AWP also improves graph-level classification. LetG = (A,X) be a given (attributed) graph whereA is the adjacency matrix andX contains the node attributes. Let V be the set
of all nodes. Normally we optimize minθ Ltrain(θ;A,X), where Ltrain = ∑ v∈Vtrain l(fθ(A,X), yv), f is a GNN parametrized by weights θ = (θ1, ...,θk), yv is the ground-truth label for node v, and l is some loss function (e.g. cross-entropy) applied to each node in the training set Vtrain ⊂ V . In AWP we first find the worst-case weight perturbation δ∗(θ) that maximizes the loss. Then we minimize the loss with the perturbed weights. The worst-case perturbation for a given θ is defined as
δ∗(θ) := arg max {δ| ||δi||2≤ρ(θi),i∈[k]} Ltrain(θ + δ;A,X), (1)
where ρ(θ) is the strength of perturbation. Then the AWP learning objective is
min θ max {δ| ||δi||2≤ρ(θi),i∈[k]} Ltrain(θ + δ;A,X) = min θ Ltrain(θ + δ
∗(θ);A,X). (2)
Since the PAC-Bayes bound proposed by McAllester (1999) only holds for i.i.d. training tasks and semi-supervised node classification is a non-i.i.d. task, analysis in Wu et al. (2020a) and Foret et al. (2021) could not be naturally extended to node classification tasks. We derived a new generalization bound for node classification tasks on GNNs based on the sub-group generalization (Ma et al., 2021). Theorem 1. (informal). Let Lall(θ;A,X) be the loss on all nodes, including the unseen test nodes. It is bounded by the adversarially weight perturbed loss on the training nodes as follows:
Lall(θ;A,X) ≤ max {δ| ||δi||2≤ρ(θi),i∈[k]} Ltrain(θ + δ;A,X) + h(||θ||22/ρ(θ)2) (3)
The formal version, the details for h(), and the proof are in Appendix E. This bound justifies the use of AWP since the perturbed loss on training nodes bounds the standard loss on all nodes. Moreover, as h(||θ||22/ρ(θ)2) is monotonously decreasing with ρ(θ), increasing the perturbation strength ρ can make the bound in Eq. 3 sharper, i.e. the resulting AWP objective should lead to better generalization.
Since finding the optimal perturbation (Eq. 1) is intractable, we approximate it with a one-step projected gradient descent as in previous work (Wu et al., 2020a; Foret et al., 2021; Zheng et al., 2021),
δ̂∗(θ) := ΠB(ρ(θ))(∇θLtrain(θ;A,X)), (4)
where B(ρ(θ)) is an l2 ball with radius ρ(θ) and ΠB(ρ(θ))(·) is a projection operation, which projects the perturbation back to the surface ofB(ρ(θ)) when the perturbation is out of the ball. The maximum perturbation norm ρ(θ) could either be a constant (Foret et al., 2021; Zheng et al., 2021) or layer dependent (Wu et al., 2020a). We specify a layer-dependent norm constraint ρ(θ) := ρ||θ||2 because the scales of different layers in a neural network vary greatly. With the approximation δ̂∗(θ), the definition of the final AWP learning objective is given by
min θ Lawp(θ) := Ltrain(θ + ΠB(ρ(θ))(∇θLtrain(θ;A,X));A,X), (5)
If Ltrain(θ;A,X) is smooth enough, ∇θLtrain(θ;A,X) = 0 when θ∗ is a local extremum. In this case Lawp(θ) = Ltrain(θ;A,X). A natural question is whether θ∗ will also be the extremum of Lawp(θ)? We show that Lawp(θ) keeps the local extremum of Ltrain(θ;A,X) unchanged. Theorem 2. (Invariant of local minimum and maximum) With the AWP learning objective in Eq. 5, and for continuous Ltrain(θ;A,X),∇θLtrain(θ;A,X),∆θLtrain(θ;A,X), if θ∗ is a local minimum of Ltrain(θ;A,X) and the Hessian matrix ∆θLtrain(θ;A,X)|θ∗ is positive definite, θ∗ is also a local minimum of Lawp(θ).
The proof is provided in Appendix A. The exact gradient of this new objective is
∇θLtrain(θ + δ̂∗(θ);A,X) = ∇θLtrain(θ;A,X)|θ+δ̂∗(θ) +∇θδ̂ ∗(θ)∇θLtrain(θ;A,X)|θ+δ̂∗(θ) (6)
Since∇θδ̂∗(θ) includes second and higher order derivative of θ, which are computationally expensive, they are omitted during training, obtaining the following approximate gradient of the AWP loss
∇θLtrain(θ;A,X)|θ+δ̂∗(θ) (7) Foret et al. (2021) show the models trained with the exact gradient (Eq. 6) have almost the same performance as model trained with the estimated first-order gradient (Eq. 7).

heading: 4 WEIGHTED TRUNCATED AWP
text: In this section we discuss the theoretical limitations of existing AWP methods on GCN, and illustrate them empirically on a toy dataset. We also propose two approaches to improve AWP. Our improved AWP works well on both toy data and on real-world GNN benchmarks across many tasks and models. We also show that similar problems also exist for multi-layer perceptrons (see Appendix B).

heading: 4.1 THE VANISHING-GRADIENT ISSUE OF AWP
text: Consider a GCN ŷ = σ(Â(...(ÂXW1)...)Wn) with a softmax activation at the output layer, where Â is the graph Laplacian given by Â := D−1/2(A + IN )D−1/2, Dii = ∑ j(A + IN )ij . The
perturbed model is ŷ = σ(Â(...(ÂX(W1+δ1)))...(Wn+δn)). Since the norm of each perturbation δi could be as large as ρ||Wi||2, in the worst case the norm of each layer is (ρ + 1)||Wi||2, and thus the model will have exploding logit values when ρ is large. After feeding large logits into the softmax layer, the output will approximate a one-hot encoded vector, because the difference between the entries of the logits may also be large. In this case the gradient will be close to 0 and the weights will not be updated. Notice, although in practice the number of GCN layers is always less than 3, we still observe the vanish gradient issue in both toy datasets and GNN benchmarks.
To verify our conclusion, we train a 2-layer GCN network with hidden dimension 64, which is a common setting for GCNs, on a linearly separable dataset. The dataset contains 2 classes {−1, 1} and each class has 100 nodes. We apply k-nearest neighbor (k = 3) to obtain the adjacency matrix, and use the position of the nodes as the features. The number of training epochs is 200. We use 10% nodes for training, 10% for validating and the rest 80% for testing. In Fig. 1 we show the trained classifiers for different ρ values. Models with AMP crash quickly when ρ increased from 0.5 to 2.5. When ρ = 0.5, the classification accuracy is 0.97, which is nearly the same as the vanilla model, but when ρ = 2.5, the classification accuracy is 0.51, which is the same as a random guess. Besides, when ρ = 1.5 and 2.5, the loss of AWP method is almost constant dur-
ing training (Fig. 2) and the prediction score (Fig. 1(c) and Fig. 1(d)) is around 0. This indicates that the weights are barely updated during training. So with the AWP objective, we cannot select a large ρ. Yet, as we discussed in Sec. 3, we prefer larger values of ρ since they lead to a tighter bound (Eq. 3) and are more like to generalize better. As we shown next, our suggested improvements fix this issue.

heading: 4.2 TRUNCATED AWP AND WEIGHTED AWP
text: Intuition for WT-AWP. The vanishing gradient is mainly due to the exploding of the logit values, which is caused by perturbing all layers in the model. Thus, a natural idea is to only apply AWP on certain layers to mitigate the issue. This it the truncated AWP. Another idea is to provide a second
Algorithm 1 Weighted Truncated Adversarial Weight Perturbation Input: Graph G = (A,X); model parameters θ = [θ(awp);θ(n)] with and without AWP; number of epochs N ; loss function Ltrain; perturbation strength ρ, AWP weight λ; learning rate α. Initialize weight θ0; for t ∈ 1:N do
Compute the loss for training nodes: Ltrain(θt−1;A,X) Compute the approximating weight perturbation for θ(awp)t−1 : δ̂ ∗(θ (awp) t−1 ) via Eq. 4
Compute the approximating gradient for θ: g = λ∇θLtrain(θ;A,X)|θt−1+[δ̂∗(θ(awp)t−1 ),0] + (1− λ)∇θLtrain(θ;A,X)|θt−1 Update the weight via θt = θt−1 − αg
end return θN
source of valid gradients which we do by adding the the vanilla loss Ltrain(θ;A,X) to the AWP loss. Even when the AWP loss suffers from the vanishing gradient issue, the vanilla loss is not affected.
Definition 1. (Truncated AWP) We split the model parameters into two parts θ = [θ(awp),θ(normal)], and we only perform AWP on θ(awp). The Truncated AWP objective is
min θ Ltrain(θ + [δ̂
(awp)∗(θ(awp)), 0];A,X), (8)
where δ̂(awp)∗(θ(awp)) := ΠB(ρ(θ(awp)))(∇θ(awp)Ltrain(θ(awp);A,X)).
Recall in Sec. 2, the AWP objective is the unweighted combination of the regular loss function L(θ) and the sharpness term maxδ≤ρ[L(θ+ δ)−L(θ)]. The weight perturbation in this term can lead to vanishing gradients as we discussed in Sec. 4.1. Therefore, another way to deal with this issue is to assign a smaller weight λ to the sharpness term in the AWP objective. The weighted combination is [λmaxδ≤ρ[L(θ + δ)− L(θ)] + L(θ)] = [λmaxδ≤ρ L(θ + δ) + (1− λ)L(θ)]. Definition 2. (Weighted AWP) Given a weight λ ∈ [0, 1] the Weighted AWP objective is
min θ
[λLtrain(θ + δ̂ ∗(θ);A,X) + (1− λ)Ltrain(θ;A,X)] (9)
We compare these two improvements with AWP and natural training on a linearly separable dataset using the same setup as in Sec. 4.1. Fig. 3 illustrates the trained models with ρ = 2. In Fig. 3(b) we can see that the model with AWP objective suffers from vanishing gradients and it fails to learn anything useful. The models with Truncated AWP1 (θ(awp) = first layer and θ(normal) = last layer) (Fig. 3(c)) and Weighted AWP (Fig. 3(e)) work well and have relatively good performance (96% and 98% accuracy respectively). Besides, comparing to the vanilla model (Fig. 3(a)), they both have a significantly smoother decision boundary.
In order to obtain a more powerful approach against the vanishing-gradient issue, we combine Truncated AWP and Weighted AWP, into a Weighted Truncated Adversarial Weight Perturbation (WTAWP). The details of WT-AWP are shown in Algorithm 1 (description in Sec. B.1). WT-AWP has two important parameters λ and ρ. We will study how they influence model performance in Sec. 5.7.
1In Fig. 3(c) we perturb only the first-layer. Perturbing only the second layer instead performs similarly.

heading: 5 EXPERIMENTAL EVALUATIONS
text: We conduct comprehensive experiments to show the effect of our WT-AWP on the natural and robustness performance of different GNNs for both node classification and graph classification tasks.
Training frameworks and setup. We utilize the open-source libraries Pytorch-Geometric (Fey and Lenssen, 2019) and Deep-Robust (Li et al., 2020) for evaluation clean and robust node classification performance respectively. To achieve fair comparison we keep the same training settings for all models. We report the mean and standard deviation over 20 different train/val/test splits and 10 random weight initializations. See Sec. D.4 for further details and for the training hyperparameters.
Datasets. We use three benchmark datasets, including two citation networks, Cora and Citeseer (Sen et al., 2008), and one blog dataset Polblogs (Adamic and Glance, 2005). We treat all graphs as undirected and only select the largest connected component (more details and statistics in Sec. D.3).
Baseline models and attacks. We aim to evaluate the impact of our WT-AWP on natural and robust node classification tasks. We train three vanilla GNNs: GCN (Kipf and Welling, 2017), GAT (Veličković et al., 2018), and PPNP (Klicpera et al., 2018), and four graph defense methods: RGCN (Zhu et al., 2019)2, GCNJaccard (Wu et al., 2019), GCNSVD (Entezari et al., 2020), and SimpleGCN (Jin et al., 2021). For detailed baseline descriptions see Sec. D.1. To generate the adversarial perturbations, we apply three methods including: DICE (Waniek et al., 2018), PGD (Xu et al., 2019), and Metattack (Zügner and Günnemann, 2019). For a discussion of the attacks see Sec. D.2.
Certified robustness. We obtain provable guarantees for our models using a black-box (sparse) randomized smoothing certificate (Bojchevski et al., 2020). We report the the certified accuracy, i.e. the percentage of nodes guaranteed to be correctly classified, given an adversary that can delete up to rd edges or add up to ra edges to graph (similarly for the node features). See Sec. D.8 for details.
Settings for WT-AWP. All baseline models have a 2-layer structure. When applying the WT-AWP objective, we only perform weight perturbation on the first layer i.e. we assign θ(awp) = first layer and θ(normal) = last layer. For generating the weight perturbation we use a 1-step PGD as discussed in Sec. 3. In the ablation study Sec. 5.7 we also apply 5-step PGD to generate weight perturbation, in which we utilize SGD optimizer with learning rate 0.2 and update the perturbation for 5 steps, and finally the perturbation is projected on the l2 ball B(ρ(θ)).

heading: 5.1 CLEAN ACCURACY
text: We evaluate the clean accuracy of node classification tasks for different GNNs and benchmarks. The baseline methods include GCN, GAT, and PPNP . We use a 2-layer structure (input-hidden-output) for these three models. For GCN and PPNP, the hidden dimensionality is 64; for GAT, we use 8 heads with size 8. We choose K = 10, α = 0.1 in PPNP. We also find that the hyperparameters (λ, ρ) of WT-AWP are more related to the dataset than the backbone models. We use (λ = 0.7, ρ = 1) for all three baseline models on Cora, (λ = 0.7, ρ = 2.5) on Citeseer, and (λ = 0.3, ρ = 1) for GCN, (λ = 0.3, ρ = 2) for GAT and PPNP on Polblogs. Table 1 show our results, WT-AWP clearly improves the accuracy of all baseline models, while having smaller standard deviations. Note, we do not claim that these models are state of the art, but rather that WT-AWP provides consistent and statistically significant (two-sided t-test, p < 0.001) improvements over the baseline models. These results support our claim that WT-AWP finds local minima with better generalization properties.

heading: 5.2 AVERAGE OF GRADIENT NORM IN THE INPUT SPACE
text: To estimate the smoothness of the loss landscape around the adjacency matrix A and the node attributes X , we compute the average norm of the gradient of Ltrain(θ;A,X) w.r.t. A and X . We compare a vanilla GCN model with GCN+WT-AWP (λ = 0.5, ρ = 1) model on Cora and Citeseer. We train 10 models with different random initializations. For each model we randomly sample 100 noisy inputs around A and X , and we average the gradient norm for these noisy inputs. When comparing models trained with and without WT-AWP, we keep everything else fixed, including the random initialization, to isolate the effect of WT-AWP. In Fig. 4, we can observe that in most cases (37 out of 40) the models trained with WT-AWP have both better accuracy and smaller average gradient norm, i.e. are smoother. This provides evidence that WT-AWP can help us find flatter minima.
2Note, we cannot apply WT-AWP to RGCN as the weights are modeled by distributions.
5.3 VISUALIZATION OF LOSS LANDSCAPE
We train GCN, GCN+AWP (ρ = 0.1) and GCN+WT-AWP (λ = 0.5, ρ = 0.5) models with the same initialization, and we compare their loss landscapes. The accuracy is 83.55% for GCN, 84.21% for GCN+AWP, and 85.51% for GCN+WTAWP. Similar to Stutz et al. (2021), Fig. 5 shows the loss landscape in a randomly chosen directionu in weight space, i.e. we plot Ltrain(θ + α · u;A,X) for different steps α. We generate 10 random directions u and show the average loss. The loss landscape of GCN+AWP is slightly smoother than the vanilla GCN, because of the small perturbation strength ρ = 0.1.
GCN+WT-AWP is flatter (and more accurate) than both of them due to the larger perturbation strength ρ = 0.5. This provides further evidence for the effectiveness of WT-AWP.

heading: 5.4 ROBUST ACCURACY WITH POISONING ATTACKS
text: Next we show that our WT-AWP can improve existing defense methods against graph poisoning attacks. We select two poisoning attacks: PGD and Metattack (Zügner and Günnemann, 2019), with a 5% adversarial budget. The baseline models are vanilla GCN, and three GCN-based graph-defense models: GCNJaccard, GCNSVD, and SimpleGCN. For all attack and defense methods, we apply the default hyperparameter settings in Li et al. (2020), which re-implements the corresponding models with the same hyperparameters as the original works. We use Cora, Citeseer, and Polblogs as the benchmark datasets. Note that GCNJaccard does not work on Polblogs as it requires node features. Table 10 in the appendix shows the hyperparameters (λ, ρ) we select for all WT-AWP models.
As we can see in Table 2, none of the defense methods have dominant performance across benchmarks. More importantly, our WT-AWP consistently improves the robust accuracy for both vanilla and robust models. We also evaluate the models against the DICE poisoning attack in Sec. C.2, and again the results demonstrate that WT-AWP adds meaningful improvement over the baselines.

heading: 5.5 ROBUST ACCURACY WITH EVASION ATTACKS
text: Next we show that WT-AWP also improves existing defense methods against graph evasion attacks. We select two evasion attacks, DICE and PGD, with perturbation strengths of 5% and 10%. The baseline model is GCN and we perform experiments on three benchmarks: Cora, Citeseer, and Polblogs. For the PGD attack the hyperparameters (λ, ρ) are (0.5, 0.5) for all datasets. For the DICE attack we use (0.5, 0.5) for Cora, (0.7, 2) for Citeseer, and (0.3, 1) for Polblogs. Table 3 shows the experimental results. WT-AWP again meaningfully improves the robustness of GCN under both PGD and DICE evasion attacks.

heading: 5.6 CERTIFIED ROBUSTNESS
text: In this subsection, we measure the certified robustness of GCN and GCN+WT-AWP on the Cora dataset with sparse randomized smoothing (Bojchevski et al., 2020). We use λ = 0.5, ρ = 1 as the hyperparameters for the WT-AWP models. We plot the certified accuracy S(ra, rd) for different addition ra and deletion rd radii. In Fig. 6, we see that compared to vanilla GCN training, our WT-AWP loss significantly increases the certified accuracy w.r.t. feature perturbations for all radii, while maintaining comparable performance when certifying perturbations of the graph structure. For additional results see Sec. C.3.

heading: 5.7 ABLATION AND HYPERPARAMETER SENSITIVITY STUDY
text: We compare the performance of GCN+WT-AWP on the Cora dataset for different λ and ρ values. We also compare GCN+WT-AWP with GCN+AWP under different perturbation sizes ρ. Table 4 lists the results. The accuracy of GCN+WT-AWP first increases with λ and ρ and then slightly decreases. Truncated AWP is a special case for λ = 1 (since the (1−λ) term disappears in Eq. 9) and it does not perform well, especially for larger ρ. Similarly, WT-AWP outperforms the vanilla AWP that suffers from the vanishing-gradient issue. Weighted but not truncated AWP with λ = 0.5 (last row) is also worse than WT-AWP, although in general weighting seems to be more important than truncation. These results justify the decision to combine our proposed weighted and truncated AWP methods.
We also generate perturbations as in Eq. 4 but with multi-step PGD. We repeat the above experiment with applying 5-step PGD for WT-AWP. As shown in Table 5, the performance of 5-step WT-AWP is similar to the 1-step WT-AWP, the accuracy of both models first increases with λ and ρ, and then decreases. The optimal hyperparameters (λ, ρ) are ρ = 1, λ = 0.7. Since 5-step PGD offers no benefits and 1-step PGD is faster, we suggest this as the default setting when applying WT-AWP.

heading: 5.8 GRAPH CLASSIFICATION
text: Finally, we conduct experiments on graph classification tasks with three benchmark datasets: Protein, IMDB-Binary and IMDB-Multi. Detailed description is in Sec. D.9. Table 6 shows the experimental results. Generally, WT-AWP improves the accuracy with a large margin. Besides, the variance of the accuracy of GCN+WT-AWP across different random seeds is significantly smaller than the vanilla GCN, which indicates that WT-AWP is also more stable. Note, we do not claim that our models are state of the art, but rather that WT-AWP provides consistent improvements.

heading: 6 CONCLUSION
text: We proposed a new adversarial weight perturbation method, WT-AWP, and we evaluated it on graph neural networks. We showed that our WT-AWP can improve the regularization of GNNs by finding flat local minima. We conducted extensive experiments to validate our method. In all empirical results, WT-AWP consistently improves the performance of GNNs on a wide range of graph learning tasks including node classification, graph defense, and graph classification. Further exploring the connections between flat minima and generalization in GNNs is a promising research direction.

heading: REPRODUCIBILITY STATEMENT
text: All datasets, baseline models, and general training settings are listed at the beginning of Sec. 5. For specific tasks we include the detailed settings in the corresponding sections. For example, the detailed model structure and hyperparameter settings for GCN clean accuracy is discussed in Sec. 5.1. We will make our code available to the reviewers via an anonymous link posted on OpenReview as suggested by the guidelines.

heading: ETHICS STATEMENT
text: In this paper we design a new regularization method that can improve the robustness of graph neural networks again adversarial attacks. Making GNNs more robust can have positive or negative broader impacts depending on the application and the domain. While we observed that WT-AWP improves both clean and robust generalization, we did not study whether these improvements come at a cost to e.g. the fairness of the model, or whether they introduce certain biases in the model.

heading: A PROOFS
text: Proof. (Theorem 2) We only show the proof with local minimums, the proof with local maximum is analogous. For ease of calculation we denote Ltrain(θ;A,X) by L(θ). We need to show a)∇θL(θ+ ∇θL(θ))|θ∗ = 0, and b) ∆θL(θ +∇θL(θ))|θ∗ is positive definite. a) Since θ∗ is a local minimum of L, we have ∇θL(θ)|θ∗ = 0, thus
∇θL(θ +∇θL(θ))|θ∗ = (I + ∆θL(θ∗))∇θL(θ)|θ∗+∇θL(θ)|θ∗ = (I + ∆θL(θ ∗))∇θL(θ)|θ∗ = 0 (10)
b)
∇θ(∇θL(θ +∇θL(θ)))|θ∗ = ∇θ[(I + ∆θL(θ))∇θL(θ +∇θL(θ))]|θ∗ = ∇θ(I + ∆θL(θ))|θ∗∇θL(θ)|θ∗+∇θL(θ)|θ∗ + (I + ∆θL(θ))|θ∗∆θL(θ)|θ∗+∇θL(θ)|θ∗ (I + ∆θL(θ))
T |θ∗ = (I + ∆θL(θ))|θ∗∆θL(θ)|θ∗(I + ∆θL(θ))T |θ∗
(11)
Because (I + ∆θL(θ))|θ∗ and ∆θL(θ)|θ∗ are positive definite matrices, and ∇θ(∇θL(θ + ∇θL(θ)))|θ∗ = (I + ∆θL(θ))|θ∗∆θL(θ)|θ∗(I + ∆θL(θ))T |θ∗ is symmetric, ∇θ(∇θL(θ + ∇θL(θ)))|θ∗ is positive definite. Thus θ∗ is also the local minimum of L(θ +∇θL(θ)).
B VANISHING-GRADIENT ISSUE OF AWP ON MLP
In this section we show that the vanishing-gradient issue also happens in multi-layer perceptrons. Consider an MLP ŷ = σ(Wn(...(W1X))) with a softmax activation at the output layer. The perturbed model is ŷ = σ(((Wn+δn)(...((W1+δ1)X))). Since the norm of each perturbation δi could be as large as ρ||Wi||2, in the worst case the norm of each layer is (ρ+1)||Wi||2, and thus the model will have exploding logit values when ρ is large. After feeding large logits into the softmax layer, the output will approximate a one-hot encoded vector, because the difference between the entries of the logits will also be large. The gradient will be close to 0 and the weights will not be updated.
To verify our conclusion we train a 3-layer linear network with W1 ∈ R2×100,W2 ∈ R100×100,W3 ∈ R100×2 on a linearly separable dataset, the number of training epochs is 2000. In Fig. 7 we show the trained classifiers with different ρ. We find that models with AWP are crushed quickly when ρ increased from 0.2 to 0.25. When ρ = 0.25, the value of loss function remains unchanged during training and the prediction score is around 0, which indicates the weights are almost not updated during training. So with the AWP objective, we cannot select a large ρ.
We repeat the experiment using the same 3-layer linear network on a 2d moons dataset and perform the weight perturbation only on the first two layers. Fig. 8 Illustrates the trained models with ρ = 0.4.
In Fig. 8(b) we can see the model suffers from vanishing gradients, while the model with truncated AWP works well (Fig. 8(c)). Besides, comparing to the overfitted natural model (Fig. 8(a)), the truncated AWP model has a smoother decision boundary. We also remove the weight perturbation on the middle or the first layer and train the model correspondingly, the results are similar to Fig. 8(c). As Fig. 8(d) shows, the model with the weighted AWP objective is able to learn the representation of the input data, and the decision boundary is also smoother than the nature model in Fig. 8(a).

heading: B.1 DESCRIPTION OF ALGORITHM 1
text: In the WT-AWP algorithm (Algorithm 1) we apply a numerical optimizer such as Adam to the WT-AWP objective
LWT−AWP (θ) = [λLtrain(θ + [δ̂ (awp)∗(θ(awp)), 0];A,X) + (1− λ)Ltrain(θ;A,X)]
Since in our empirical experiments the GNNs always have a 2-layer structure, we assign θawp as the first layer and θnormal as the last layer. Then the perturbation δ̂(awp)∗ (first layer) is computed via Eq. (4). Next the gradient g of LWT−AWP is calculated with Eq. (6).
g = λ∇θLtrain(θ;A,X)|θt−1+[δ̂∗(θ(awp)t−1 ),0] + (1− λ)∇θLtrain(θ;A,X)|θt−1
Finally we update the weight via θt = θt−1 − αg.

heading: C ADDITIONAL EXPERIMENTS

heading: C.1 LEARNING CURVES AND GENERALIZATION GAP DURING TRAINING
text: In this part, we train GCN, GCN+AWP (ρ = 0.1) and GCN+WT-AWP (λ = 0.5, ρ = 0.5) models with the same random initialization and compare their learning curves, and generalization gap. The accuracy is 0.8355 for GCN, 0.8421 for GCN+AWP, and 0.8551 for GCN+WT-AWP. Fig. 9(a) illustrates the learning curve of vanilla loss Ltrain(θ;A,X) during training. The loss of all three models converges well. The final value of GCN+WT-AWP is larger than the rest two models. We believe it is because GCN+WT-AWP finds a different (flatter) local minimum. Fig. 9(b) shows the generalization gap during training. Because we use a large perturbation bound ρ in GCN+WT-AWP, its generalization gap fluctuates more and decrease slower compared to the gap of GCN+AWP. The fluctuation is due to the exploding logit problem in AWP with a large ρ value. When it happens, the regular loss included in WT-AWP can minimize (but not completely eliminate) its influence. Despite the fluctuation, the generalization gap of GCN+WT-AWP decreases with time as well.

heading: C.2 ROBUST ACCURACY WITH POISONING DICE ATTACK
text: We conduct additional experiments on poisoning the graph with DICE attacks. The general model settings are the same as Sec. 5.4. The WT-AWP hyperparameters (λ, ρ) are shown in Table 8. Table 7 illustrates the experimental results. The models that achieve best performance on a given dataset are all based on WT-AWP. Besides, WT-AWP also consistently boost the performance of the baselines.

heading: C.3 CERTIFIED ROBUSTNESS ON CITESEER DATASET
text: We measure the certified robustness of GCN and GCN+WT-AWP with randomized smoothing (Bojchevski et al., 2020) on the Citeseer dataset. We use λ = 0.5, ρ = 1 as the hyperparameters for WT-AWP models. We plot the certified accuracy S(ra, rd) w.r.t. ra and rd. As seen in Fig. 10, comparing with the vanilla GCN, WT-AWP significantly increases the certified accuracy for perturbations to the node features for all radii, while having comparable performance for certification of the graph structure.

heading: D EXPERIMENTAL DETAILS

heading: D.1 DESCRIPTION OF BASELINE MODELS
text: We aim to evaluate the impact of our WT-AWP on natural and robust node classification tasks, thus we utilize the well-known graph neural networks and graph defense methods as baseline. We first train the baseline models and compare their performance with the baseline models trained with WT-AWP objective (if applicable). The baseline GNN models include:
• GCN (Kipf and Welling, 2017): is one of the most representative graph convolution neural networks. Currently it can still achieve SOTA on different graph learning tasks.
• GAT (Veličković et al., 2018): utilizes multi-head attention mechanism to learn different weights for each node and its neighbor node without requiring the spectral decomposition.
• PPNP (Klicpera et al., 2018): improves the GCN propagation scheme based on the personalized Pagerank. This approach generates predictions from each node’s own features and propagates these predictions using an adaptation of personalized PageRank.
• RGCN (Zhu et al., 2019): applies the Gaussian distribution to model the node representations. This structure is expected to absorb effects of adversarial attacks. It also penalizes nodes with large variance with an attention mechanism. Notice, the WT-AWP cannot be applied to RGCN, as the weights of RGCN are modeled by distributions. We can regard RGCN as another model inspired by PAC-Bayes theorem, as it models the objective Eδ∼N (0,σI)[Ltrain(θ + δ;A,X)], which also bounded Lall(θ;A,X) according to PAC-Bayes theorem.
• GCNJaccard (Wu et al., 2019): is a graph defense method based on GCN. It pre-processes the graph by deleting edges, which connect nodes with a small Jaccard similarity of features, because attackers prefer connecting nodes with dissimilar features. This method only works on graph with node features. For example it cannot work on Polblogs because the node features are unavailable.
• GCNSVD (Entezari et al., 2020): is a graph defense method based on GCN, which focuses on defending nettack Zügner et al. (2018). Since nettack is a high-rank attack, GCN-SVD preprocesses the perturbed graph with its low-rank approximation. It is straightforward to extend it to non-targeted and random attacks.
• SimpleGCN (Jin et al., 2021): utilizes similarity preserving aggregation to integrate the graph structure and the node features, and employs self-supervised learning to capture the similarity between node features. Notice SimpleGCN is not specifically designed for graph defense, and we find it also has good performance under the poisoning attacks, thus we add this method as another graph defense baseline.

heading: D.2 DESCRIPTION OF GRAPH ATTACK METHODS
text: Generally speaking, there are two types of the adversarial attacks on node classification tasks: testtime attack (evasion) and train-time attack (poisoning). In both types of attacks we first generate a perturbed adjacency matrix based on a victim model, and then in evasion attacks we test it directly on the victim model, and in poisoning attacks we train a new model with the perturbed adjacency matrix. For generating the adversarial perturbations, we apply three methods:
• DICE (Waniek et al., 2018): is a baseline attack method (delete internally, connect externally). In each perturbation, we randomly choose whether to insert or remove an edge. Edges are only removed between nodes from the same classes, and only inserted between nodes from different classes.
• PGD (Xu et al., 2019): calculates the gradient of the adjacency matrix, and the gradient serves as a probabilistic vector, then a random sampling is applied for generating a near-optimal binary perturbation based on this vector.
• Metattack (Zügner and Günnemann, 2019): was proposed to generate poisoning attacks based on meta-learning. It has an approximate version A-Metattack. In our experiments, we apply the original Metattack.

heading: D.3 DATASETS STATISTICS
text: Cora and Citeseer (Sen et al., 2008) are citation datasets commonly used for evaluating GNNs. Polblogs (Adamic and Glance, 2005) is another common benchmark dataset where each node is a political blog. In Table 9 we provide the statistics for each graph. We preprocess the graph and only use the largest connected component.

heading: Datasets Cora Citeseer Polblogs

heading: D.4 TRAINING SETUP
text: Optimization hyperparameters. We use the Adam optimizer with a learning rate 0.01 and weight decay of 0.0005. All models are trained for 200 epochs with no weight scheduling. We add a dropout layer with rate p = 0.5 after each GNN layer during training. We apply no early stopping and the optimal model is selected with its performance on the validation set. The test set is never touched during training.
Train/val/test split. The evaluation procedures of GNNs on node classification tasks have suffered overfitting bias from using a single train-test split. Shchur et al. (2018) showed that different splits could significantly affect the performance and ranking of models. In all our experiments on node classification tasks, we apply the split setting in Zügner and Günnemann (2019), which utilizes 10% samples for training, 10% samples for validating, and 80% samples for testing. We generate 20 random splits and for each split we train 10 models with different random initialization. We report the mean and standard deviation of the accuracy of the 200 random models in our results.

heading: D.5 SETTINGS OF THE AVERAGE OF GRADIENT NORM
text: For the results in Sec. 5.2 we generate noise zA, zX from Gaussian distribution N (A, σ2I) and N (X, σ2I), then calculate the l2 norm of the loss gradient ||∇ALtrain(θ;A,X)|A=zA ||2 and ||∇XLtrain(θ;A,X)|A=zA ||2. In our experiments we choose σ = 0.0005, because we expect the perturbed input to be close to the clean input.

heading: D.6 SETTINGS OF VISUALIZATION OF LOSS LANDSCAPE
text: For the results in Sec. 5.3, we generate a random direction u from a Gaussian distribution and perform l2 normalization, it is equal to randomly selecting a direction on the l2 unit ball. As seen in Fig. 9(a), there is a large gap between the final loss value of WT-AWP and vanilla GCN, we have to parallel move the loss landscape of WT-AWP and GCN to the same level for making comparison. The experiments are performed on Cora, similar results also hold for other datasets.
D.7 HYPERPARAMETERS (λ, ρ) FOR POISONING ATTACKS

heading: D.8 RANDOMIZED SMOOTHING
text: Following Bojchevski et al. (2020), we create smoothed versions of our GNN models by randomly perturbing the adjacency matrix (or the node features) and predicting the majority vote for the randomly-perturbed samples. We denote with pa the probability of flipping an entry from 0 to 1, i.e. adding an edge or a feature, and with pd the probability of flipping an entry from 1 to 0, i.e. deleting an edge or a feature. In all experiments, for the certification of node features we generate random perturbations with pa = 0.01, pd = 0.6, and for perturbing the adjacency matrix we use pa = 0.001, pd = 0.4. We consider the prediction of the smoothed GNN for a given node correct if and only if it is correct and certifiably robust. This means the prediction of the node does not change for any perturbation within the radius (i.e. for any rd deletions or ra additions).

heading: D.9 GRAPH CLASSIFICATION
text: Datasets. We use three popular graph classification datasets, including one bioinformatics dataset Proteins, and two social network datasets IMDB-Binary and IMDB-Multi (Yanardag and Vishwanathan, 2015) for evaluation. The details are shown in Table 11.
Settings. We use 80% samples for training, 10% samples for validating and the rest 10% for testing. The baseline model is a two-layer GCN with 16 hidden dimension and a global mean pooling layer after the second graph convolution layer. A linear read-out layer is attached to the output of the GCN to generate predictions. We apply the same training settings for GCN and GCN+WT-AWP. We train both models for 200 epoches with the Adam optimizer, learning rate 0.01 and weight decay 0.0005. The best model is selected with only the validation accuracy. For each of GCN and GCN+WTAWP we take 10 random initialization and report the average accuracy and standard deviation. The hyperparameters (λ, ρ) of WT-AWP is (0.3, 0.5) for Proteins, (0.05, 0.1) for IMDB-M and (0.5, 0.1) for IMDB-B.

heading: D.10 NORM OF GRADIENT DURING TRAINING
text: In this experiment we train a vanilla GCN, GCN+AWP with ρ = 0.1, GCN+WT-AWP with λ = 0.5, ρ = 1 on Cora and plot the relative gradient norm ||∇θ||2/||θ||2 during training. Both AWP and WT-AWP have small relative gradient norm compared to GCN when epoch is larger than 100.

heading: D.11 ABLATION STUDY OF THE PERTURBED LAYER
text: Since in all experiment above we only perturb the first layer of GNN with WT-AWP, we provide experimental results corresponds to perturb only the second layer with WT-AWP. The backbone is GCN and the benchmark is Cora. As Table 12 shows, skipping the first layer in WT-AWP methods have worse performance than skipping the last layer.

heading: E GENERALIZATION BOUND ON GNN NODE CLASSIFICATION
text: Theorem 3. (generalization bound) Assuming Lall(θ;A,X) ≤ Ez∼N (0,Σ)[Lall(θ + z;A,X)], for any set of training nodes Vtrain from Vall, ∀m > √ d, with probability at least 1− δ, we have
Lall(θ;A,X) ≤ max ||δ||2≤ρ
[Ltrain(θ + δ;A,X)] + ( m2
d e1−
m2
d )d/2
+ 1√ N0
( 1
2
[ 1 + d log(1 +
m2||θ||22 dρ2 )
] + ln 3
δ +
1 4 + Θ(K · all)
) .
(12)
where d is the number of parameters in the GNN, K is the number of groundtruth labels, all is a fixed constant w.r.t. Vall, N0 is the volume of Vtrain.
We use the assumption in Foret et al. (2021), Lall(θ;A,X) ≤ Ez∼N (0,Σ)[Lall(θ + z;A,X)], which means that adding Gaussian perturbation should not decrease the test error.
Proof. Our proof is motivated by the subgroup generation bound on node classification tasks (Ma et al., 2021) and the intuition of theorem 1 in Foret et al. (2021).
Lemma 1. (PAC-Bayes bound node classification tasks (Ma et al., 2021)) For any set of training nodes Vtrain from Vall, for any subgroup of nodes Vm ⊂ Vall, for any prior distribution P , with probability at least 1− δ, for any distribution Q we have
Eθ∼Q[Lm(θ;A,X)] ≤ Eθ∼Q[Ltrain(θ;A,X)] + 1√ N0 (DKL(Q||P) + ln 3 δ + 1 4 + Θ(K m)) (13)
where N0 is the volume of the training set Vtrain, K is the total number of classes, m is a constant depend on the subgroup Vm.
If we take Vm = Vall in Lemma 1, we have
Eθ∼Q[Lall(θ;A,X)] ≤ Eθ∼Q[Ltrain(θ;A,X)] + 1√ N0 (DKL(Q||P) + ln 3 δ + 1 4 + Θ(K all)) (14)
Assume both P and Q are Gaussian distributions with diagonal covariance matrix, i.e. Pi ∼ N (µp, σ2pId}), Qi ∼ N (µq, σ2qId}), where d is the dimension of θ, we have
DKL(Q||P) = 1
2
[ d log
σ2p σ2q − d+ d σ2q σ2p + ||µp − µq σp ||22
] , (15)
Take µq = θ, µp = 0, we expect the KL-divergence DKL(Q||P) to be as small as possible w.r.t. σp.
Lemma 2. (Foret et al., 2021) Take µq = θ, µp = 0. There exist pre-defined σp such that
DKL(Q||P) ≤ 1
2
[ 1 + d log(1 +
||θ||22 dσ2q )
] (16)
Thus we have the generalization bound
Eθ∼Q[Lall(θ;A,X)] ≤ Eθ∼Q[Ltrain(θ;A,X)]
+ 1√ N0
( 1
2
[ 1 + d log(1 +
||θ||22 dσ2q )
] + ln 3
δ +
1 4 + Θ(K all)
) (17)
As Q ∼ N (θ, diag{σ2q}), consider z ∼ N (0, diag{σ2q}), we have zσq ∼ N (0, Id) and Eθ∼Q[Ltrain(θ;A,X)] = Ez[Ltrain(θ + z;A,X)]. Thus we have ∀m > 0
Eθ∼Q[Ltrain(θ;A,X)] = Ez[Ltrain(θ + z;A,X)]
= Ez[Ltrain(θ + z;A,X)| || z
σq ||2 ≤ m]P(||
z
σq ||2 ≤ m)
+ Ez[Ltrain(θ + z;A,X)| || z
σq ||2 > m]P(||
z
σq ||2 > m))
≤ max ||δ||2≤mσq
[Ltrain(θ + δ;A,X)]P(|| z
σq ||2 ≤ m) + P(||
z
σq ||2 > m).
≤ max ||δ||2≤mσq
[Ltrain(θ + δ;A,X)] + P(|| z
σq ||2 > m).
(18)
As zσq ∼ N (0, Id), by Chernoff bound of chi-squred distribution we have when m > √ d,
P(|| z σq ||2 > m) ≤ (
m2
d e1−
m2
d )d/2 (19)
Thus
Eθ∼Q[Ltrain(θ;A,X)] ≤ max ||δ||2≤mσq
[Ltrain(θ + δ;A,X)] + ( m2
d e1−
m2
d )d/2, (20)
combining it with Eq. 17 and denote σq = ρ/m we have
Lall(θ;A,X) ≤ max ||δ||2≤ρ
[Ltrain(θ + δ;A,X)] + ( m2
d e1−
m2
d )d/2
+ 1√ N0
( 1
2
[ 1 + d log(1 +
m2||θ||22 dρ2 )
] + ln 3
δ +
1 4 + Θ(K all)
) .
(21)

Review summaries:
The paper designed and tested WT-AWP, a new adversarial weight perturbation approach, on graph neural networks. They demonstrated that by locating flat local minima, our WT-AWP can improve the regularization of GNNs. They carried out comprehensive tests to verify the method. WT-AWP reliably increases GNN performance on a wide range of graph learning tasks, including node classification, graph defense, and graph classification.

The authors extend the line of work related to adversarial weight perturbations: first showing that a vanishing gradient issue in standard AWP can hinder training. To remedy this, some natural tweaks are applied to AWP. The authors then focus on using AWP to train graph neural networks, demonstrating a minor boost in both clean and robust accuracy.  

This work studies how AWP improves the GNN, mainly at the generalization aspect. The authors first derive several theoretical results that can be easily derived from the existing works on CNN, e.g., Wu et al., 2020a and Foret et a;., 2021 in section 3.. In section 4, the authors show that if they directly apply large $\rho$ as suggested by (3), they will encounter the gradient vanishing phenomenon during the training. Based on this phenomenon, the authors propose two ways to solve this. One is truncated AWP, the other is weighted AWP. Then, the authors conduct simple experiments using Vanilla GCN, GCN+AWP, GCN+TAWP, GCN+WAWP, where Vanilla perform the best whereas GCN+TAWP, GCN+WAWP have smoother decision boundary. And they decide to combine T+W with AWP (to be frank, I do not know why they do not add experiment result of WT-AWP here.) In section 5, the authors conduct a lot of experiments like clean accuracy, robust accuracy, etc, which follow the existing works.  The contribution as I can see is that the authors are the first ones to conduct extensive experiments using AWP on graph dataset. However, I do not see other contributions listed by the authors, which I will explain later in the main review.