Self-supervised Adversarial Purification for Graph Neural Networks
Authors: Woohyun Lee
Hogun Park
Venue: ICML 2025 poster (2025)
Keywords: Self-supervised Learning
Adversarial Robustness
Graph Neural Networks
Adversarial Purification
Graph Auto Encoders
Primary area: deep_learning->robustness

Abstract: Defending Graph Neural Networks (GNNs) against adversarial attacks requires balancing accuracy and robustness, a trade-off often mishandled by traditional methods like adversarial training that intertwine these conflicting objectives within a single classifier. To overcome this limitation, we propose a self-supervised adversarial purification framework. We separate robustness from the classifier by introducing a dedicated purifier, which cleanses the input data before classification. In contrast to prior adversarial purification methods, we propose GPR-GAE, a novel graph auto-encoder (GAE), as a specialized purifier trained with a self-supervised strategy, adapting to diverse graph structures in a data-driven manner. Utilizing multiple Generalized PageRank (GPR) filters, GPR-GAE captures diverse structural representations for robust and effective purification. Our multi-step purification process further facilitates GPR-GAE to achieve precise graph recovery and robust defense against structural perturbations. Experiments across diverse datasets and attack scenarios demonstrate the state-of-the-art robustness of GPR-GAE, showcasing it as an independent plug-and-play purifier for GNN classifiers. Our code can be found in https://github.com/woodavid31/GPR-GAE.

Self- Self-supervised Adversarial Purification for Graph Neural Networks
Woohyun Lee'
Hogun Park
Abstract
the underlying graph structure, even small perturbations drastically degrade their performance, making them highly vulnerable to adversarial attacks (Xu et al. 201 Geisler et al. 2021). Defending against such attacks requires balancing accuracy and robustness. Accuracy measures per- formance on clean data, while robustness reflects resilience to adversarial attacks. Focusing on accuracy can make a model rely on adversarially vulnerable features, while prior- itizing robustness may reduce this reliance but harm clean data performance.
Defending Graph Neural Networks (GNNs) against adversarial attacks requires balancing ac- curacy and robustness, a tradc-off' often mishan- dled by traditional methods like adversarial train- ing that intertwine these conflicting objectives within a single classifier. To overcome this limi- tation, we propose a self-supervised adversarial purification framework. We separate robustness from the classifier by introducing dedicated pu- rifier, which cleanses the input data before clas- sification. In contrast to prior adversarial purifi- cation methods, we propose GPR-GAE, a novel graph auto-encoder (GAE), as specialized puri- fier trained with a self-supervised strategy, adapt- ing diverse graph structures in a data-driven manner. Utilizing multiple Generalized PageRank (GPR) filters, GPR-GA GAE captures diverse struc- tural representations for robust and effective pu- rification. Our multi-step purification process fur- ther facilitates GPR-GA GAE to achieve precise graph recovery and robust defense against structural per- turbations. Experiments across diverse datasets and attack scenarios demonstrate the state-of-the- art robustness of GPR-GAE, showcasing it as an independent plug-and-play purifier for GNN classifiers. Our code can be found https: //github. wttp:/ww.........aaii.l11.... wttpaaiiiii////-//.a////
Adversarial training (Goodfellow et al. 2015; Madry et al. 2018), one of the earliest defense methods in the image domain, has been adapted into GNNs (Xu et 2019a; Feng et al. 2019; Li al. 2022: Zhang et al. 2022; Gosch et al. 2023) enhance robustness under adversarial settings in graphs. However, it inherently intertwines the two conflict- ing objectives in single learning framework. This limits the achievable robustness, as pursuing higher robustness often comes at the expense of significant accuracy loss. Moreover, adversarial training often falls short broad applicability, showing efficiency in a narrow set of GNNs.
On the other hand, adversarial purification (Wu et al., 2019; Entezari et al., 2020; Li et al., 2024) provides viable frame- work by introducing separate module-a purifier-that preprocesses the input data to defend against attacks. It focuses on removing adversarial components and purifying the input data, allowing each module to specialize in its own role: the purifier enhances robustness, while the clas- sifier focuses solely on accuracy. This separation provides clear pathways for each module to leverage its strengths in- dependently, avoiding interference between the conflicting objectives of accuracy and robustness. However, existing purification methods do not fully capitalize on this potential, often relying on predefined heuristics without a dedicated training process (Wu et 2019; Entezari et al. 2020) or a simple edge detection method (Li al. 2024). Heuristic- based approaches lack adaptivity and leave defenses highly vulnerable to carefully crafted attacks (Mujkanovic et al. 2022), while classifier-derived edge representations do not capture intricate structural differences between clean and adversarial edges, resulting in suboptimal performance.
1. Introduction
Graph Neural Networks (GNNs) have become a powerful tool for learning on graph-structured data, with applications in social networks (Fan et al. 2019), biological networks (Zhang et al. 2021), and recommender systems (Wu al. 2022). Moreover, they have been expanded to domains such as self-supervised learning (Jung& & Park 2025) and explain- ability (Kang et al. 2024). However, due to their reliance
'Department of Computer Science and Engineering, Sungkyunkwan University, Suwon, South Korea. Correspondence to: Hogun Park <hogunpark @kku..duk..
Proceedings of the ndnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).
Based on these observations, our work makes several key contributions adversarial purification in GNNs. First, we

---

Self-supervised Adversarial Purification for Graph Neural Networks
analyze and decouple the conflicting objectives of accuracy
2. Preliminary
and robustness in adversarial training into two components:
2.1. Problem Formulation and Notation
classifier for accuracy and purifier trained independently to restore graph structures. Under the adversarial purifica- tion framework, we design a self-suuervised training strat- egy, ensuring the purifier's independence from the classifi- cation task and mitigating trade-offs. Second, as the purifier, we introduce GPR-GAE, a novel graph auto-encoder ar- chitecture that leverages multiple Generalized PageRank (GPR) filters to capture diverse and unique neighborhood representations. This allows effective distinction between clean and adversarial graph regions by modeling complex structural differences, while enabling accurate encoding and reconstruction of a cleaner graph structure. Third, we adopt multi-step purification process that iteratively re- fines the graph with convergent nature, yielding more precise and effective purification. Finally, through extensive experiments across diverse datasets and attack scenarios, we demonstrate that GPR-GAE excels as specialized pu- rifier, achieving state-of-the performance while serving as a aang--and-payyy defense module that is compatible with various GNNs.
We represent a graph G as G = (V,E), where V is the set of N nodes and
the set of edges, or equivalently as [A, X), with A E RRN as the adjacency matrix and X RNx as the feature matrix, where F denotes the feature dimension. While normalized adjacency matrix with self- loops, A, = D 1/2 + I) D 1/2 is commonly used, our approach adopts Ans = D D-1/2 AD 1122,, excluding self- loops. Here, D, and D are the respective degree matrices.
This work addresses adversarial attacks on Graph Neural Networks (GNNs) through structural perturbations, where attackers manipulate edges (insertions or deletions) to de- grade performance. We denote the perturbed graph as G' (A', X) and seek to recover a structure closer to the clean graph G (A, X). Unlike poisoning attacks tar- geting the training phase, we focus on evasion attacks, the same problem setting as adversarial training. which occurs at the test phase. Following Gosch et al. (2023), we employ an inductive setting, excluding validation and test nodes during training to prevent information leakage (memorizing the graph for defense) and ensure fair evaluation.
1.1. Related Work
Adversarial Training:
Gosch et al. (2023) emphasizes that flexible GNN architectures (Chien et al. 2021; He et al. 2022) excel in adversarial training settings due to their abil- ity to learn robust propagation pathways by dynamically weighting different powers of the adjacency matrix.
2.2. Learning Objective of Adversarial Training
Adversarial training (Xu et al. 2019a; Li et al. 2022; Gosch et al. 2023) enhances the robustness of GNN classifier fe against evasion attacks by iteratively generating adversarial examples and training the classifier on them. The overall objective can be formulated as:
Some methods forgo adversarial training and focus on designing a robust GNN architecture as a defense. For example, EvenNet (Lei et al. 2022) ignores odd-hop neighbors and uses an even even-polynonn pven-polyoomial graph fil- ter, while Sof (Geisler al. 2021) uses soft- median aggregation with GDC to mitigate the influence of outliers. However, robust GNNs share the same limita- tions as adversarial training, where accuracy and robustness goals are tightly coupled within the architectural designs, constrained by inherent trade-offs.
Robust GNNs:
[(v) G.E)(G.))
max
ENEV(EUSM ()), v)).
(1)
Here, G' is an adversarially perturbed graph sampled from B c), the set of graphs obtained from G via bounded number of edge or feature modifications and constrained by the perturbation budget e. Each node v E V has a true label ye. and denotes the loss function. Training alternates between generating the worst-case G', which maximizes the loss, and updating classifier parameters &i to minimize the expected loss over G'.
Adversarial Purification: faccard-GCN (Wu et al. 2019) prunes edges between nodes that have Jaceard similarity below a threshold. SVD-GCN (Entezari et al. 2020) finds that attacks tend to affect high-rank components of the graph and perform a low-rank approximation to purify the graph. GOOD-AT (Li et al. 2024) integrates adversarial training and purification by generating adversarial samples using a PGD attack (Xu et al. 2019a) on a pre-trained GCN (Kipf & Welling 2017) classifier. It encodes edges with features and classifier logit embeddings, training an ensemble of MLP detectors to distinguish between clean (in-distribution) and adversarial edges flagged as OOD by any detector are pruned.
2.3. Generalized PageRank Filter
The Generalized PageRank (GPR) filter, introduced in GPRGNN (Chien et al., 2021), provides flexible mech- anism for dynamically adjusting the contribution of each propagation step during message passing. This is achieved through learnable coefficients *ik which weigh the k-th power of the normalized adjacency matrix A The prop- agation rule is expressed as H Σ 7h (AtH())
edges. During testing,
where in GPRGNN, H is the initial feature-driven logit embeddings. By learning the coefficients y = (oo...., 7k].
2

---

Self-supervised Adversarial Purification for Graph Neural Networks
the GPR filter flexibly adapts the contribution of information from different neighborhood ranges, up to K-hops. This adaptability allows GPR filters to dynamically capture and aggregate neighborhood information, being suitable for both homophilic and more complex heterophilic graphs.
performance on clean data. As a result, most adversarial training methods keep the attack budget during training rel- atively low to preserve the clean accuracy. Consequently, it inherently limits the level of robustness that can be achieved through training, leaving the classifier vulnerable to stronger attacks that exceed the restricted budget.
3. Motivations
The limitations in adversarial training motivates a fundamen- tal redesign: can we decouple the objectives of accuracy and robustness, assigning them to specialized modules that address each goal more effectively?
3.1. Self-supervised Adversarial Purification
We discuss the motivations behind our use of self- supervised adversarial purification framework for defending against adversarial attacks. We first analyze the learning objective of adversarial training and highlight the inherent trade-off between accuracy and robustness. The adversarial training objective can be decomposed as follows:
Therefore, we propose a self-supervised adversarial purifi- cation framework with clear efforts to fully decouple the accuracy and robustness objectives. The two are explic- itly handled and learned in separate modules with distinct specializations. This contrasts with previous adversarial purification approaches, which either replace the purifier with predefined heuristics or make the purifier dependent on the classifier's samples and representations.
Theorem 3.1 (Decomposition of Adversarial Training). Given disjoint sets of nodes V Vunaffected S V and V Vaffected V, representing those unaffected and affected by adversar- ial perturbations in G', respectively, such that Vinofeected U [Vanstonal
The accuracy objective is assigned to a standard GNN classifier, fex which focuses solely on learning accurate representations from the clean graph G. This is reflected in the following typical supervised learning objective:
Vofternd- = V, let X = [VI where X E [0, 1), denote the proportion of unaffected nodes. The adversarial training objective for a GNN classifier foy can be decomposed as follows:
((()) = X E EBVEVongton Vengfrenn [e(fe(G.)), vol]
C = EvEV (C(F u))
(2)
Accuracy Term
The robustness objective, in turn, is assigned to separate purifier model, So. which does not learn to predict node labels. Instead, it focuses on reconstructing the clean graph G from perturbed inputs G', which naturally aligns with the following self superviueeii objective:
+ (1 - A)- max
BveVagee (e(folG' ()),
('EB(G.E)
Robustmess Term
Proof. Provided in Appendix A.I.
In particular, a node is considered affected by an adver- sarial perturbation if a modification exists within its local propagation boundary. For instance, in 2-layer GCN (Kipf & Welling, 2017), a node is affected if there are perturba- tions within its two-hop neighborhood.
[ = ((fo(G) G',B(GGC).
(3)
In our sule--upe approach, unlike adversarial train- ing's worst case samples, we randomly choose G' from the sample space B, with relatively large training budget c. This allows the purifier So to learn general purification di- rections across a broader range of perturbations around G, enabling more robust and adaptive purifications.
The decomposition separates the adversarial training objec- tive into two distinct terms: accuracy and robustness. Given that the local structure of node is denoted as S. and the perturbed local structure as S", the accuracy term focuses learning the mapping from (v, Sw) to the true label you while the robustness term focuses on learning the mapping from (v. ) to ye- Meanwhile, within the decomposition, the attack budget c indirectly determines Vunaticcued controlling the value of and emphasis on each term.
3.2. Convergent Multi-Step Purification Framework
Traditional purification methods often use single-step pro- cess, modifying the perturbed graph G' by pruning or retain- ing edges based on fixed criteria. Although simple, these methods make abrupt changes with rough discretization of the graph, limiting their ability to precisely recover clean graph structures under complex heavy perturbations.
However, excessive emphasis on the robustness term can introduce perturbations that drastically alter the nodes' se- mantics, rendering the mapping from (v, .)) to ye mean- ingless for learning useful representations. The coexistence of such potentially detrimental learning within the overall objective can hinder the learning of meaningful representa- tions from the clean graph structure, ultimately constraining
The proposed multi-step purification framework addresses these limitations by iteratively refining the graph through a dynamic, data-driven approach. Instead of abrupt correc- tions, the purifier model fe progressively adjusts the graph structure using the learned purification directions, adapting
3

---

Self-supervised Adversarial Purification for Graph Neural Networks
to the graph's 's current state at each step. This gradual refine- ment not only enhances recovery accuracy but also enables the method to handle severe perturbations more effectively, Moreover, a convergent nature is crucial in multi-step purifi- cation in order to ensure stability and prevent oscillatory or divergent behavior during iterative refinement. The follow- ing theoretical analyses formalize the convergent behavior of our self-super multi-step purification framework:
Two-Layer Static GNN
GPR-:: Y b=b+-]]
GPR-0: y=[+]
GPR-1:
[+,+]
6
V
5
GPR-3: y= [-s+]]
GPR-2: y [-00++
Assumption 3.2. Under optimal self- suff-sueeeeiee training over a sufficiently large and continuous perturbation space B(G,e) e) around the clean graph G. the purification model fe behaves locally Lipschitz continuous function with Lipschitz constant L E [0, 1).
Figure 1. Conceptual Comparison: Node v's receptive fields (dot- ted lines) when adversarially linked to node v' (from a different community). Left: Two-layer static GNN, Right: Five GPR fil- ters, cach with unique coefficients y = 1,,,...., 7k] of varying scales. "Im. controls neighbors m-hop away from node v. GPR-2, self- suppresppprss (70- < 0) and two-hop neighborhood emphasis (72 > 0) form a houndary around nodes [2.3,4.5). GPR-3 further suppresses one-hop neighborhood (71 0), excluding nodes? 2 and 3, to form a boundary with nodes {4.5}.
The local Lipschitz behavior of So arises from the self- supervised training objective, which minimizes the recon- struction error (lJ) - Gl| for perturbed inputs within B(G,c) while enforcing fG) = G for the clean graph. Under optimal training, the model is encouraged to satisfy (G)) [G)]l S P| G|| for some small constant p 1), implying that fo approximates a locally Lips- chitz continuous mapping with Lipschitz constant L E [0, 1) around G. In the inductive setting, the test graph is semanti- cally similar to G, and thus the locally Lipschitz property of fo extends naturally to perturbation neighborhoods around the test graph. Empirical verification of the assumption under various dataset shown in Section 6.2.
ods must well leverage structural properties such neigh- borhood relationships or higher-order dependencies. Graph auto-encoders (GAEs) are naturally suited for this task, as they encode and reconstruct graph structures, modeling both node and edge relationships. However, traditional GAEs face two key challenges in adversarial settings:
Perturbations in the graph can propagate through the structure, blurring distinctions be- tween clean and attacked regions. Traditional GAEs rely on static GNN layers (Kipf& & Welling 2017; Hamilton et al. 2017; Xu et al. 2019b) for neighbor aggregation, which inad- vertently smooth local variations. This causes adversarially connected nodes to become similar in representation, reduc- ing the model's ability to differentiate clean and attacked regions. Moreover, standard GAE decoders (Pan et al. 2018; Li et al. 2023) often use mrximity-bbsedd measures such as inner or sementtwise products, further exacerbating this issue by reconstructing spurious connections.
Adversarial Smoothing:
Theorem 3.3 (Convergence of Multi-Step Purification). Let G()) G' be an adversarially perturbed graph, and let Se be purification model trained and applied in a self- supervised manner. A1 each step t, define the purification direction as AG = ) GG(), and update the graph iteratively as ((++1) = ( +a-A where E (0, 1] the step size. Given Assumption 3.2, the sequence (G()) converges linearly to a stationary point G
Proof. Provided in Appendix A.2.
Difficulties Higher-Order Representations: Captur- ing higher-order structural information in GAEs typically requires stacking multiple GNN layers. However, as the number of layers increases, oversmoothing occurs (Rusch et al. 2023). where node representations across the graph become indistinguishable. This limits traditional GAEs to low-order structural properties, further reducing their effi- cacy in purifying attacked graphs.
The theorem guarantees that, under the local Lipschitz con- dition induced by the self-supervised training objective, the iterative purification process converges to a stable graph structure regardless of the step size. Importantly, this con- vergence is governed by the behavior of the purification model in isolation. In contrast, incorporating external sig- nals, such as arbitrary classifier outputs, may interfere with the stability of the refinement process. The proposed decou- pling of the purifier from the classifier is therefore essential for ensuring both theoretical convergence and robustness against adversarial attacks.
Motivated by these limitations, we propose GPR-GAE, a novel graph auto-encoder architecture that utilizes diverse representations from multiple GPR filters, addressing the challenges of traditional GAEs while enhancing the struc- tural capabilities. The key intuitions are as follows:
3.3. Designing the Purifier
To effectively differentiate clean from attacked graph re- gions while adapting to diverse structures, purification meth-
i) Flexible Neighborhood Aggregation: GPR filters em- play learnable coefficients ? to selectively aggregate neigh-
4

---

Self-supervised Adversarial Purification for Graph Neural Networks
borhood information from different ranges. Unlike stacking static GNN layers, this approach prevents oversmoothing, preserving node-level distinctions while effectively captur- ing higher-order structural dependencies.
4.2. Edge Encoding
The edge representation E. 122,, where Ze is the edge embedding dimension, is computed as:
iii Diverse Structural Aspects: As illustrated in Figure 1, each GPR filter captures unique structural neighboring as- pects of nodes through learnable continuous coefficients, with their sign and magnitude enabling fine-grain ine-grained empha- sis or suppression of the corresponding neighborhoods. By leveraging multiple unique GPR filters with varying sizes, GPR-GAE can utilize diverse, multi-scale structural rep- resentations. This allows modeling of complex structures while mitigating adversarial smoothing by avoiding reliance on single representations derived from fixed aggregations.
E Φ (H [ H W..
(6)
where the concatenation of encoded node embeddings of and j are transformed by an activation function and a multiplication by learnable weight matrix We.
4.3. Edge Decoding
The encoded edge embeddings are variant, where E and E are two different representations. So we first compute the directed link prediction score:
We further extend our motivations in Appendix G, empir- ically showing how GPR-GAE moves beyond the simple proximity focus of traditional GAFs to capture complex structural properties. The appendix demonstrates GPR- GAE's ability to leverage higher-order information and distinguish between proximal connections, highlighting its advanced structural encoding capabilities and forming a foundation for its application in adversarial purification.
A (((E)))) Wa).
(7)
where Wa E 2 is a learnable weight vector and is the sigmoid function. Given that our work focuses on undirected graphs, the final link prediction score Aij is obtained by averaging the bidirectional predictions:
A Ai + Áz
A.j
(8)
2
4. GPR-GAE
The resulting A.j values form the predicted adjacency trix Å, where each entry represents the probability of an edge existing between the corresponding nodes.
4.1. Node Encoding
We employ K ++1 distinct GPR filters to capture multi-scale structural information across varying neighborhood sizes. The output of the k-th GPR filter, Ha, (k O,..., : K), is:
5. A Adversarial Purification
5.1. Perturbed Graph Sampling for Training
Ho. mm (A H ()), H = X W., (4)
To sample perturbed graphs for training, we define the sam- ple space B(G, (p, n)),, where we apply three random perturbation methods sequentially to G. The parameters P. q, 1) represent the budgets for each perturbation method.
Here, 7% Me .e....... A are the learnable coeffi- cients for the k-th GPR filter, where T weighs the contri- bution of the m-hop neighborhood. (()) E Nxx denotes the initial linearly transformed node embeddings, where Zi is the embedding dimension. Note that Ha, = (0) is fixed as the initial node embeddings. We use a normalized adja- cency matrix without self-loops (Ane) to reduce potential excessive self-influence, promoting aggregation from dis- tinct neighborhoods for more discriminative representations.
i) Edge Injection. We begin by injecting new edges into the graph G (V, E). Specifically, uniformly sample set of edges Einject C E., where Eº denotes the set of edges not present in E. The number of injected edges is determined by the injection ratio p. such that |Einjeca = p-ppee 1-) These edges are added to the graph, resulting in edge set E = E Enjoett
ii) Edge Masking. Next, we mask a subset of edges from the modified graph. The masked edge is defined as Emask onii U Emask inj. where:
The final encoded node embedding, denoted as H GPRGAF e IR. N (K++)) is formed by concatenating the representa- tions from all K+1 GPR filters:
Emask & consists of original edges uniformly sampled from E, with |mmakk = q (E).
H GPRGAE
Ho.-
5
Emask inj S Eijject consists of injected edges uniformly sampled from Enjjecs with [mmaskiinj] = q |Eijjcrt)-
This concatenation creates a rich, multi-scale representation for downstream tasks to effectively utilize.
Edge masking results an edge set E' E' &muskk-
5

---

Self-supervised Adversarial Purification for Graph Neural Networks
iii) Edge Reweighting, Finally, we reweight the remaining edges in E'. For each edge in E originally weighted as 1, we assign new weight randomly sampled from the range [8, B - ni. where 17 is a scaling factor. Note that the specific value of / is inconsequential, as it is normalized during adjacency matrix processing.
0.7
Accuracy
0.6
a = 0.3
0.5
0.5
a
0.4
Resulting Perturbed Graph. The perturbed graph sam- pled from B (p. q. 17)) defined as G" = (V,E") where E' incorporates the effects of edge injection, masking, and reweighting. Equivalently, G" can be represented as (A', where A' is a modified adjacency matrix with the continuous edge weights. While edge injection and edge masking define discrete boundaries for the sample space, edge reweighting smooths these boundaries into continuous space. This enables the learning of more generalized AG, more specifically, AA A A', providing directions for purifying the graph structure toward its clean state.
Steps
Figure 2. GCN classifier performance on attacked Cora. Node clas- sification accuracy over purification steps using GPR-GAE multi- step purification with T = 1/1000, and a E (0.3, 0.5, 0.7, 1).
weights in Aseat are iteratively updated as:
(++1) A (1) a AA (t)
(12)
AA (4) A (8)
A (0)
(0) So(A Xres).
5.2. Learning Objective
Here, A Atest and AA adjusts the graph structure based on (+), The step size a E (0. 1] balances retaining the current state and incorporating updates. The process
The learning objective of GPR-GAE to purify the per- turbed graph G' by restoring its adjacency matrix A' to approximate the original A. The model takes G' as input and outputs link score predictions A, representing edge likelihoods in Eall = m U Emjectt These predictions are optimized with the following two losses:
terminates when |AA || S T. The final refined adjacency matrix, A", is passed to the GNN classifier f& without dis- cretization, producing the final classification f (A' X.ea).
Figure 2 illustrates the accuracy across purification steps using GPR-G- GAR as the purifier. The classification accuracy improves with each step, demonstrating the effectiveness of the multi-step purification process. The results also show consistent convergence across all values under the termi- nal condition. For practical use, we set a = 1, 1/1000, and limit the maximum purification steps to 5.
(i) Restoration Loss. The restoration loss quantifies the model's is ability to recover the structure of the original graph. It optimizes the link prediction scores Å for positive edges in E and negative edges in Einject- The loss is defined as:
Lrestore
log(1 - Aij)
[3]
(WEEE 1
5.4. Computational Complexity
log( (gg)
EEnject
(ij)EEEnseet
In real-world graphs, where the number of nodes is N, the number of edges is [&], the feature and the hidden dimen- sion is Z, the complexity of node encoding in GPR-GAE is O(K |8| Z). the same as GCN with K-layers. For multi- step purification process with the number of maximum pu- rification steps fixed 5, the complexity is O 181 22). We provide detailed derivations in Appendix B.
(ii) Symmetry Loss. The symmetry loss ensures consis- tency in link prediction scores for edges in Eall regardless of node ordering. It is defined as:
Laym
Σ (A 1 ?
(10)
|Eaul
(i,))EEa
6. Experiments
The total loss function combines these objectives:
We conducted experiments on various datasets including Cora, Cora ML, Citeseer (Bojchevski Günnemann 2018). Pubmed (Sen et al. 2008), OGB-arXiv (Hu et al. 2020), and Chameleon with removed duplicates (Platonov et al. 2023). We use an inductive split with 20 labeled nodes per class for train and validation, a stratified test set of 10% of nodes, and the remaining nodes as unlabeled training data. For Chameleon and OGB-ar OGB-arXiv, we use their provided splits with fully labeled training sets.
(())= Crestore + Layms
(11)
where > 0 balances restoration and symmetry losses, ensuring consistency throughout the predictions.
5.3. Multi-step Purification Process
During the test stage, the purification process is applied to the test graph Grest = (Atest X.ex). At each step i, the edge
6

---

Self-sueervised Adversarial Purification for Graph Neural Networks
Table Adaptive attack: Test accuracy (%) on Cora for models with different methods: Vanilla (standard training). Self-training sheeud-labbeling Adversarial training (PRBCD or LRBCD with training 0.2), and GPR-GAEas paired with either vanilla or self-traine classifiers. Robust GNNs (EvenNet, Sof)MedianGDC) are compared alongside GCN variants, Results are evaluated under clean conditions and adversarial attacks (LRBCD and PRBCD) with varying budget c. Bold values indicate the best performance within each calegory, while curly underlined values highlight the second-best performance.
Adv.
(Adv.cval) (Adv.tr) J.
LRBCD c=0.1
PRBCD c=0.1
LRBCD c.2.25
PRBCD c=0.25
LRBCD c=0.5
PRBCD
Model
Pur.
Lah.
Clean
c=5.5
EvenNet
X
X
81.42200
63.2422.
65.7+114
54,921.1
$1,7433
45.7+0.5
35,62009
Sof
77.41:88
69.14:19
6..34.9
64.1414
60:11
59.14:12
48.241111
Vanilla
79.4
64.242.33
60.1
51,24006
46.915
40.5
29.342.3
telf-trained
X
82.5.10.9
70.7::1.6
65.0110.
60.7
$2.74:1.
48.11.1
37.242.1
GON
Adv--tuiieed
X
LRBCD PRBCD
80.511
70.4::322
63.8
62.84277
$1.1114
$26428
3.
Aniinr
69.51:1.
61.6122.
51.7122
34.61199
GPR-GAF SPRR-GAFCCY
PCCN.
794403
25.912.00
356521
34.1E14
69.71:29
61.3336
GPR-GAEEeN,sa
816407
78.5+:166
7..3+099
76.6:1
60,0-112
16
608+14
Vanilla
764113
50.2.124
50,514400
29.5
36.21142
198124
214115
Self-trained Adv-trained
79442.
53.516.11
53.024.6
34.916.1
36.5558
24.1
24.8
LRBCD
80.72088
67.400.7
62.02088
$9442.4
48.420.5
50.52277
3.
Adv.tmiined
PRBCD
50.6.138
GPR-G GAAT Vauila
760116
71342.1
018424
69.0
65.TEL1
67.1
39,9
GPR-GA Sax
794422
74.922
7..0
7.88139
69.3:1
71.7:1455
60.5
Vanilla
SLAL12
65.6.10.7
63.011.4
55.6.10.9
49.4:11.9
44.212.7
33.1
GPRGNN
Self-trained
8LILLS
68.541.3
65,5222
60.22233
51.8113
36.8119
Adv-trained
LRBCD
80.110
7121:300
6.
64.8:22
$4.01112
$7.7114
38.212.77
Adv. trained
8
PRBCD
79.5.20
73.22288
68.01.244
68.5.33.1
61,1144
62.8..5.66
48.5
OPR-GAFGPRGNNE
81GELI
71.41.
77.0108
76.4
70.6:12.
75.6:1199
6..2:1..0
GPR-GAEGPRONS seit
80.116
71211100
25.9112
355A11
7024116
JAZALA
6164110
Vanilla Self-trained
X
821112
66.24:1.
64.520088
56.41133
$09912
46.0:::.5
32.6+2.6
823118
70.61::0
68.211.11
62.1128
$4.71100
51113322
37.71.200
APPNP
Ariierd
8
LRBCD
824115
715113
66.6
63.412.8
$4.0.114
$4.41888
35.6.12.3
Advetrained
PRBCD
812L15
712411
67.6
64.1
$5.3413
54.1-00.7
37.843.22
GPR-GAFE APPNY Vanilla
81GE1A
716218
37
7244119
76,4188
64.3227
GPR-GAEAPNN-Sa
82.5+177
79.622.3
77.3-22
77.9222
J14423
76.52227
68.2-2.0
GPR-GAE. We set K = 7, symmetry loss factor 0.2, and the training sample budget to (p, q, 7)) = (1.5, 0.2, 3), with q 0.5 tuned for OGB-arXiv. We provide abla- tion studies of GPR-GAE in Appendix F. Additionally, GPR-GAEGNN denotes GNN classifier performing infer- ence on the purified graph produced by GPR-GAE.
LRBCD to create adversarial training samples. Additionally the non-adversarial counterpart, self-training, uses pseudo- labeling without adversarial training, and the expansion of the training set typically increases the robustness of both adversarial and self-training through generalization.
6.1. Experimental Results
Attacks. PRBCD (Geisler et al. 2021) 1) a gradient- based topology attack that perturbs graph structures by optimizing an attack objective over randomized edge blocks, adhering defined perturbation budget. Its local constraint variant, LRBCD (Gosch et al. 2023), applies restrictions to perturba- tions within node's local neighborhood, simulating more realistic attack scenarios. The for attacks parametrizes the global budget A = ΣvEv, / relative to the degree d, for the set targeted nodes V4.
Adaptive attack. We evaluate robustness under adaptive at- tacks, where the attacker has full knowledge of the model's architecture and parameters, crafting model-specific worst- case perturbations. Our adversarial purification method, GPR-GAE, is tested in two configurations inafgurraions--attcceed to either vanilla or self-trained classifiers compared against vanilla, self-training, adversarial training, and robust GNNs (EvenNet. SoftMedianGDDC, For the baseline classi- fier, employ four GNN models: GCN, GAT (Veličković et al. 2018), GPRGNN, and APPNP (Gasteiger et al. 2019). Note that GPRGNN demonstrated sfate-of-the-arr robust- ness under adversarial training the prior work, flexibly learning robust propagation pathways in adversarial settings.
Adversarial Training. For adversarial training, we follow the pseudo-labeling framework proposed by Gosch et al. (2023). For datasets with unlabeled training nodes, sep- arate classifier is pre-trained previously unlabeled nodes with pseudo-labels, expanding the labeled training set. The final model is then trained on the expanded labeled training set, using either PRBCD or
labeled nodes to assign
Table highlights that, on the Cora dataset, GPR-GAE achieves significantly higher robustness compared all

---

Self-supervised Adversarial Purification for Graph Neural Networks
Vanilla
Adversarially Trained [PRBCD)
+
GAT GPRGNN APPNP
0.1
0.3
0.2
0.1
0.25
0.25
0.25
0.25
0.5
0.5
0.5
0.5
0.1
0.1
0.1
0.1
0.25
0.25
0.25
0.25
0.1
0.1
0.2
0.1
0.25
0.25
0.25
0.5
0.5
0.5
0.5
0.3
0.3
0.1
0.1
GCN
0.25
0.25
0.25
0.25
0.5
0.5
0.5
0.5
0.0
0.2
0.4
0.6
0.00
0.25
0.50
0.75
0.00
0.25
0.50
0.75
0.0
0.1
0.3
Accuracy
Accuracy
Accuracy
Accuracy
(a) Citeseer
(b) Cora ML
(c) Pubmed
(d) Chameleon
Figure 3. Adaptive Attack: Comparison of test accuracy (%) for Vanilla, Adversarial Training (PRBCD with = 0.2). and GPR-GAFeNN.Vaalle Vanilla under PRBCD attacks with perturbation budgets e = 0.1, 0.25, 0.5 on various datasets and GNN classifiers.
other GNN model variants, including robust GNNs, under adaptive attacks. For example, while adversarially trained GPRGNN (PRBCD) the most robust method aside from achieves 48.5% test accuracy against PRBCD attacks with e = 0.5, GPR-GAE Dei-GAAAEPRRNNNaaiie Vanilla improves this by 15.7 percentage points through its multi-step refinements, demonstrating its robustness under severe perturbations. Against LRBCD attacks, which restrict local edge modi- fications proportionally to node degrees, GPR-GAE main- tains strong performance, with its largest accuracy drop relative to clean data being only 8.9 percentage points for SPRR-GAGATTVaaie This underscores APE-s signifi- cance in defending against more realistic attack scenarios.
Table 2. Non-adaptive attack: Average test accuracy (%) in ad- versarial purification methods and robust GNNs under clean con- ditions and transfer attacks (PRBCD) from vanilla GCN. "OOM" indicates nuu-Of-Memoryy.
Citesser (small)
Pubmed (meeiuum)
OGB--axXiv (Barge)
Model
Clean 0.25 0.5
Clean 0.25 00.
Clean/ 0.25 0.5
GCN (Vonille)
71.5/400//5.3
73.1/
708/43.1 /.331
EvenNer
55.0/ 48.0
75.//44
66.2/ 46.7
SoftMedianGDC
51.7/52.1/37 37.5
73.9/53.5 40.2
70.5 /4.4 35.7
Juccard GCN
69.8150.4/ 40.5
74.3/46.4 /1.66.44/66.. 36.0
67.6 /3.9 /3.0
SVD-GCN
66.71 59.8 46.7
70.7 68.0 61.4
OOM
GOOD-AT
68. 68.11,60./55 65.6
73.0/ 70,5/ 68.0.
0OM
GPR-GAEEcNNNaatte
71.2/ 68.7/ 66.4
75.1/735/722 77.00
69.1/ (9.1//49.2/2... 42.3
In terms of clean accuracy, adversarially trained (PRBCD) GPRGNN sacrifices 1.6 percentage points compared to its nor-adversarial counterpart, self-trained GPRGNN. In con- trast, GPR-GAE shows minimal trade-offs, with the largest drop being 0.9 points when paired with self-trained GCN. These results demonstrate that GPR-GAE successfully miti- gates the trade-off by decoupling accuracy and robustness into separate modules with different specialties, achieving strong robustness against adaptive attacks while preserv- ing clean accuracy. Notably, for GPR-GAE, overall per- formance against attacks tends to correlate with the initial clean accuracy of the base classifier, rather than the type of GNN or whether it was self-trained or not.
GAE consistently achieves superior defense performance across all four GNN models and datasets, demonstrating both its effectiveness and broad applicability.
Non-adaptive attack. Unlike GPR-GAE, prior adversar- ial purification methods such SVD-GCN, Jaccard GCNN, and GOOD-AT rely discrete, non-differentiable purifica- tion, preventing direct gradient-based adaptive attacks and each requiring different attack strategies. For general eval- uation of adversarial purification methods, we conduct ex- periments under non-adaptive settings, transferring attacks from adaptively attacked vanilla GCNs using PRBCD. In Table 2, we compare GPR-GAEact Vanilla with prior adver- sarial purification methods and robust GNNs across datasets of varying scales: Citeseer (N = 2, 110, |ε| = 33 668), Pubmed (N = 19, 717, [8| = 44, 324). and OGB-arXiv
In Figure 3, we further compare the robustness of GPR-GAFGNN Vanilla against Vanilla and Adversarial Train- ing (PRBCD) across various datasets, including three ho- mophilic datasets (Citeseer, Cora MI, Pubmed) and a het- crophilic dataset (Chameleon). The results show that GPR-
(N = 169, 343, |3| = 1, 157, 799).
8

---

Self-sueervise Adversarial Purification for Graph Neural Networks
10
1.300
1,000
0.462
0.231
GPR Filter Index
GPR Filter Index
?
0..000
0.470
0.510
Coefficien een Volue
0.145
0.378
0.171
0.877
0.156
0.4
0.004
0.261
0.005
0.028
0.124
..262
4.345
0.440
1.104
0.812
6,908
0.549
0.179
5
0.123
0.363
0.355
0.006
0.168
0.372
0.0
0.033
0.383
.0.188
0.068
0.348
66112
0.093
0.054
0.218
0.151
4.326
-0.067
-0.329
0.106
0.019
0.270
0.032
0.045
0.161
6.240
0.078
0.011
0.028
0.013
0.272
0.199
00.09
0.094
0.229
0.161
0
7
Coefficient Index
Coefficient Index
(a) Cora
(b) Chameleon
Figure Visualization of the learned coefficients for each GPR filter in GPR-GAE. the coefficient value "a.. indicates the GPR Filter Index (i-th GPR Filter) and indicates the Coefficient Index (for j-th hop). We adjust the sign of the values so that the last cnefficient values of each GPR filter are positive.
Table 3. Empirical Lipschitz constant L.
0.5. For each pair, we compute:
Ilfo (A1 Xust) (A Xus))lF X
Cora
Cora ML
Citeseer
Pubmed
OGB-arXiv
Chameleon
|
A2/1F
0.3988
0.4587
0.2788
0.4473
0.4214
0.3238
and report the maximum value across the 100 sampled pairs as the empirical Lipschitz constant Ż. As shown in Table 3, all values remain strictly below 1, supporting the convergent nature of our multi-step purification framework.
Heuristic-based approaches such as Jaccard-GCN and SVD- GCN exhibit either significant drop in clean accuracy or limited robustness, making them less adaptable across datasets. GOOD-AT, which detects adversarial edges using classifier-based embeddings, provides improved robustness over heuristics but does not fully utilize structural informa- tion, falling short in overall compared to GPR-GAE. More- over, training of GOOD-AT relies on iterative dense matrix optimization for adversarial sample generation, making it impractical for large graphs like OGB-arXiv, limitation also present in SVD-GCN's low-rank approximation.
Unique learned filters. In Figure 4, visualize the learned coefficients of GPR-GAL under homophilic graph (Cora) and a heterophilic graph (Chameleon). Under supervised set- tings, as discussed in Chien et al. (2021), GPRGNN tends to learn a single GPR filter, with coefficients exhibiting consis- tent signs on homophilic graphs and fluctuating patterns on heterophilic ones. In contrast, GPR-GAE, trained in our self- supervised framework, learns diverse coefficients regardless of the graph's homophily. This diversity indicates that each GPR filter selectively includes or suppresses neighborhood information, resulting in distinct multi-scale structural rep- resentations. We provide visualization for other datasets in Appendix D, where the variation in learned coefficients across datasets further highlights GPR-GAE's adaptability data-driven purification model.
While robust GNNs (EvenNet, SoftMedianGDDC may achieve higher clean accuracy, GPR-GAE maintains su- perior adversarial robustness, generally with larger margins under stronger perturbations, while preserving clean accu- racy close to its attached classifier, vanilla GCN. Addition- ally, it scales efficiently to large datasets like OGB-arXiv by leveraging mini-batch processing, training with 1% of edges per epoch, and purifying the test stage graphs in both memory efficiency and robustness.
7. Conclusion
We propose a self-supervised adversarial purification frame- work for GNNs, explicitly decoupling accuracy and robust- ness to mitigate their trade-off. At its core is GPR-GAE. specialized purifier trained in a self-supervised manner, leveraging multi-scale neighborhood information for hanced structural learning. Through multi-step purification, GPR-GAE demonstrates state-of-the-ar robustness across diverse datasets and attacks, particularly under high per- turbations, while preserving clean accuracy, making it a versatile plug-and-pla, defense module for GNN classifiers.
6.2. Empirical Analysis
Empirical estimation of Lipsehitz constant. To support Theorem 3.3, we empirically estimate the local Lipschitz constant of the model on the test stage graph, where the output after single step purification is denoted as fe(A, X). We randomly sample 100 pairs of perturbed adjacency ma- trices Ag), each generated by injecting random edges into the test graph with random perturbation budget under

---

Self-supervised Adversarial Purification for Graph Neural Networks
Impact Statement
Gosch, L.,, Geisler, S., Sturm, D., Charpentier, B., Zügner, D., and Günnemann, S. Adversarial training for graph neural networks: Pitfalls, solutions, and new directions. Advances in Neural Information Processing Systems, 2023.
This paper presents work whose goal to advance the field of Machine Learning. While our work may have potential socictal implications, none require explicit highlighting in this context.
Hamilton, W., Ying. Z., and Leskovec, J. Inductive repre- sentation learning on large graphs. Advances in Neural Information Processing Systems, 2017.
Acknowledgements
This work was supported by the Institute of Information Communications Technology Planning & evaluation (ITTP) grant and the National Research Foundation of Korea (NRF) grant funded by the Korean government (MSIT) (RS-
He. M., Wei, Z., and Wen, J.-R. Convolutional neural networks on graphs with chebyshev approximation, revis- ited. Advances in Neural Information Processing Systems, 2022.
2019-11190421, HTT--2025-RB RS- RSS-2020-II20 82, RS-2024- 00438686, RRS-2024-00436633 RS-2003-000225441, RS- 2024-00448809,
Hu, W., Fey, M., Zitnik, M., Dong, Y., Ren, H., Liu, B., Catasta, M., and Leskovec, J. Open graph benchmark: Datasets for machine learning graphs. Advances in Neural Information Processing Systems, 2020.
RS-2025-
02218768, RSS-005--55433718, RS-2025-25442569 RS-
2025-02653113).
References
Jung, H. and Park, H. Balancing graph embedding smooth- ness self-supervised learning via cntematiion-theoral decomposition. In The Web Conference, 2025.
Bojchevski, A. and Günnemann, S.
Deep gaussian em- bedding graphs: Unsupervised inductive learning via ranking. In International Conference on Learning Repre- sentations, 2018.
Kang, H.,, Han, G., and Park, H. Unr-explainer: Counterfac- tual explanations for unsupervised node representation learning models. In International Conference on Learn- ing Representations, 2024.
Chien, E., Peng, J., Li, P., and Milenkovie, O. Adaptive universal generalized pagerank graph neural network. In International Conference on Learning Representations, 2021.
Kipf, T. N. and Welling, M. Semi-supervised classifica- tion with graph convolutional networks. International Conference on Learning Representations, 2017.
Entezari, N., Al-Sayouri, S. A., Darvishzadeh, A., and Pa- palexakis, E. E. All you need is low (rank) defending against adversarial attacks on graphs. International Conference on Web Search and Data Mining, 2020.
Lei, R., Wang, Z.. Li. Y., Ding, B., and Wei, Z. Even- net: Ignoring odd-hop neighbors improves robustness of graph neural networks. Advances in Neural Information Processing Systems, 2022.
Fan, W., Ma, Y., Li, Q., He, Y., Zhao, E., Tang, J., and Yin, D. Graph neural networks for social recommendation. In The Web Conference, 2019.
Li, J., Peng, J., Chen, L.,, Zheng, Z., Liang, T., and Ling, Q. Spectral adversarial training for robust graph neural network. IEEE Transactions on Knowledge and Data Engineering, 2022.
Feng, F., He, X., Tang, J., and Chua, T.-S. Graph adver- sarial training: Dynamically regularizing based on graph structure. IEEE Transactions on Knowledge and Data Engineering. 2019.
L., Wu, R., Sun, W., Chen, L.. Tian, S., Zhu, L., Meng, C., Zheng, Z., and Wang, W. What's behind the mask: Understanding masked graph modeling for graph autoen- coders. In ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2023.
Gasteiger, J., Bojchevski, A., and Günnemann, S. Com- bining neural networks with personalized pagerank for classification on graphs. In International Conference on Learning Representations, 2019.
Geisler, S., Schmidt, T., Şirin, H., Zügner, D., Bojehevski, A., and Günnemann, S. Robustness of graph neural net- works at scale. Advances in Neural Information Process- ing Systems, 2021.
Li, K., Chen, Y., Liu, Y., Wang, J., He, Q., Cheng, M., and Ao, X. Boosting the adversarial robustness of graph neural networks: An ood perspective. In International Conference on Learning Representations, 2024.
Goodfellow, J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. International Con- ference on Learning Representations, 2015.
Li, Y., Jin, W., Xu, H., and Tang. J. Deeprobust: a platform for adversarial attacks and defenses. AAAI Conference on Artificial Intelligence, 2021.
10

---

Self-supervised Adversarial Purification for Graph Neural Networks
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In International Conference on Learn- ing Representations, 2018.
Mujkanovic, F., Geisler, S., Günnemann, S., and Bojchevski, A. Are defenses for graph neural networks robust? Ad- vances Neural Information Processing Systems, 2022.
Pan, S., Hu, R., Long, G., Jiang, J., Yao, L., and Zhang, C. Adversarially regularized graph autoencoder for graph embedding. In International Joint Conference Artifi- cial Intelligence, 2018.
Platonov, O., Kuznedelev, D., Diskin, M., Babenko, A., and Prokhorenkova, L. A critical look at the evaluation of GNNs under heterophily: Are we really making progress? In International Conference on Learning Representations, 2023.
Rusch, T. K., Bronstein, M. M., and Mishra, S. A survey on oversmoothing in graph neural networks, arXiv preprint crXiv:2303.1099. 2023.
Sen, P., Namata, G., Bilgic, M., Getoor, L.,, Galligher, B., and Eliassi-Rad, T. Collective classification in network data. Al Magazine, 2008
Veličković, P. Cucurull, G., Casanova, A., Romero, A., Liò, P., and Bengio, Y. Graph attention networks. In International Conference on Learning Representations, 2018.
Wu, H., Wang, C., Tyshetskiy, Y., Docherty, A., Lu, K., and Zhu, L. Adversarial examples for graph data: Deep insights into attack and defense. In International Joint Conference on Artificial Intelligence, 2019.
Wu, S., Sun, F., Zhang, W., Xie, X., and Cui, B. Graph neural networks in recommender systems: survey, ACM Computing Surveys, 2022.
Xu, K., Chen, H., Liu, S., Chen, P.-YY, Weng, T.-W., Hong, M., and Lin, X. Topology attack and defense for graph neural networks: An optimization perspective. In In- ternational Joint Conference on Artificial Intelligence, 2019a.
Xu, K., Hu, W., Leskovec, J., and Jegelka, How powerful are graph neural networks? In International Conference on Learning Representations, 2019b.
Zhang, C., Tian, Y., Ju, M., Liu, 7., Ye, Y., Chawla, N., and Zhang, C. Chasing all-round graph representation robust- ness: Model, training, and optimization. In International Conference on Learning Representations, 2022.
Zhang, X.-M., Liang, L., Liu, L.,, and Tang, M.-J. Graph neural networks and their current applications in bioinfor- matics. Frontiers in Genetics, 2021.

---

Self-supervised Adversarial Purification for Graph Neural Networks
A. Theoretical Proofs
A.1. Proof of Theorem 3.1: Decomposition of Adversarial Training
We prove the decomposition of the adversarial training objective into accuracy and robustness terms.
Proof. The learning objective of adversarial training is:
((v)= = max G'EB(G.e)
EVER ((fe, v),
(I)
max G'EBIG.)
Σ (U)((",u)),.))
(2)
M
NEV
We partition into disjoint sets Vunalfected and Vallected; representing nodes unaffected and affected by perturbations, respectively. Then:
Σ [(s((",))).o))
E (()((C,))))
E (()o(G",)))ue))
(3)
DEV
VE Vanatiecsal
BE VEVallsed
For all Venafliectdd the predictions remain unchanged under perturbation, and thus the corresponding losses identical:
(J,(G",o),v.) = Σ
((o(GG v),
(4)
UE Vinciased
VEVinaffeed
For Vaflected, adversarial perturbations maximize the loss:
Σ
U() =
max
E
(ff(G",
(5)
G'EB(G,e) WE Vateeee
DE Vateade
Substituting back:
|unaafectee|
Matfected|
((b)) =
Σ
v.))
max G'EB(G,e)
Σ
(()((G, (6)
[V]
(unatieceed
[V]
Vanocued
vE Vantissseed
oe Vateasl
Let x-
Maniiesaal [V]
Finally, rewriting as expectations:
((V) = A EVEV. EVVVnnatin
Vanatieeua (Gf (11-1) A)
max G'EB(G,e)
Vattonl [C' Ho)]
(7)
A.2. Proof of Theorem 3.3: Convergence of Multi-Step Purification
Proof. Building on the locally Lipschitz continuity of so around (()) with constant 7. E [0, 1), we consider two cases based on the choice of a.
When a the update reduces direct application of fs:
=o(
(8)
Since fo is locally Lipschitz continuous with constant [0, it a contraction mapping.
When < 1, we can define the update operator he as:
ho GG) (1 + afo().
(9)
12

---

Self-speervised Adversarial Purification for Graph Neural Networks
For any G1, G2 in the neighborhood, have
[ho(Gi) ho (G2)l
[[ () G2) -
S [[ a)(G1 - G2) + (I((f((G))) fo(G))
(10)
$ (1 a] G2l - G2ll
= (1 a<1 L)) |[ G211-
Since and a >> 0, the contraction factor a(1 L) lies in [0, 1). so he is also contraction mapping.
In both cases, the purification update defines contraction mapping. Thus, by Banach's 's Fixed-Point Theorem, the sequence (G20) converges linearly to unique fixed point G
B. Derivation of Computational Complexity
B.1. Node Encoding in GPR-GAE
The computational complexity of node encoding in GPR-GAE is derived follows:
Initial Node Representation: Computing the initial node embedding H through linear transformation requires:
O(N 2²).
Hop Representations: The k-th hop representation computed iteratively using: An H 1)
where Ans is the normalized adjacency matrix. Each sparse matrix multiplication costs O( 2). Since this process is repeated for all hops (from H()) to H())), the total cost for computing all hop representations is:
O(K (1K-181-1 Z).
GPR Filter Representations: For each of the k-th GPR filter, the representation H is computed as:
Hep Σ T (m))
where (m) E Nx2, Summing all k hop representations for k-th GPR filter costs:
O - 2).
Summing over all K + filters, the total cost becomes:
K
Σ
k N 2) Z
= OO(K.. Z).
K=
Total Node Encoding Complexity: Combining all components:
O(N z K - . Z).
In real-world graphs, where N < |8), and given dominant term:
10, the final node encoding complexity can be simplified the
O(K |8) Z).
13

---

Self-supervised Adversarial Purification for Graph Neural Networks
B.2. Multi-Step Purification Complexity
The multi-step purification process iteratively updates the graph structure and includes three key components:
Node Encoding: Each purification step first encodes each node, which costs:
O(K 181 2).
Edge Encoding: Each encoded edge embedding with dimension Z is computed by transforming the concatenation of two encoded node embeddings. The combined input dimension 2(K + 1) Z, resulting complexity of:
O + 1-)-11 2²).
Simplifying the constants give:
O(K |8| 2²).
Edge Decoding: The edge decoder transforms the edge embeddings from Z dimensions back to single scalar. This costs:
O(EE Z).
Complexity per Step: Summing the costs of node encoding, edge encoding, and edge decoding, the overall complexity for a single purification step is:
O(K- 111 7 K |8 z2 + 11 2).
The complexity simplifies
O(K |8 7²).
Total Multi-step Purification Complexity: Assuming a fixed number of purification steps T, the total complexity for multi-step purification becomes:
O(T- K 181 2²).
With treated as a small constant of 5, this simplifies further to:
O(K -2).
C. Experimental Settings
Table C.I. Datasets
Dataset
Nodes
Edges
Features
Classes
Homophily Rate
Cora
2,708
5,278
1,433
7
0.80
Cora-ML
2,810
7,981
2,879
7
0.78
Citeseer
2,110
3,668
3,703
6
0.73
Chamelcon
890
8,854
2,325
0.23
Pubmed
19,717
44,324
500
0.80
OGB-arXiv 169,343
1,157,799
128
40
0.65
In this section, summarize the experimental settings, including GPR-GAE, other models, attacks, and adversarial training, For adversarial training and models other than GPR-GAE, mostly follow Gosch al. (2023), the prior work as the baseline for adversarial training. All experiments are conducted on an NVIDIA A100 (80GB) GPU. However, it is worth noting that GPR-GAE can be trained and applied to datasets, including OGB-arXiv, using an NVIDIA RTX A5000 (24GB). From an attacker's ' perspective, however, adaptively attacking classifiers attached to GPR-GAE using gradient-baser methods introduces significant memory constraints. This is because these attacks require storing all edge embeddings from GPR-GAE for gradient computation, including the blocks of edges sampled at each epoch PRBCD attack.
14

---

Self-supervised Adversarial Purification for Graph Neural Networks
While GPR-GAE can be applied OGB-arXiv by purifying the graph in batches, the gradient-based attacks cannot leverage the batching strategy in their gradient computations for generating attacks. As result, adaptive attacks GPR-GAE become unscalable (which could be seen an advantage on our part), and we evaluate robustness on OGB-arXiv only in transfer attack settings. Furthermore, PGD attacks (Xu et al., 2019a) are particularly unscalable, as they require computing gradients for all possible edges, making them impractical to attack GPR-GAE even on small-scale graphs like Citeseer.
C.1. Models
GCN: Two-layer GCN with 64 hidden units. For OGB-Or a three-layer GCN with 256 hidden units. While training, a dropout of 0.5 is applied.
GAT: Two-layer GAT with 64 hidden units. Single attention head and 0.5 dropout during training.
GPRGNN: Two-layer MLP with 64 hidden units for the initial feature transformation. The GPR coefficients randomly initialized while total of K = 10 diffusion steps are applied with 0.2 MLP dropout during training.
Two-layer MLP with 64 hidden units for the initial feature transformation. A total of K = 10 diffusion steps are applied with 0.5 MLP dropout during training. For the coefficients, "/K- = (1 - aa)* and 7 a(1 aa) for < K, with fixed as 0.1.
APPNP:
GPR-GAE:
We set K= 7, 21 = 128, and Z₃ 512, using the ELU activation function. The GPR coefficients initialized randomly. During training, we apply an MLP dropout rate of 0.7 for node encoding, while no dropout is used for edge encoding or decoding. For the OGB-arXiv dataset, we use mini-batch training with a batch ratio X = 0.01, sampling 1% of the original and inserted edges for each training epoch. During the test stage, adjacency matrix predictions are performed in batches, which does not affect the performance purification process. Full-batch training and purification are applied to all other datasets.
Jaceard-GCN: The edges are filtered based on Jaccard dissimilarity with a threshold of 0.01. For the model, we use the DeepRobust library (Li et al. 2021), with modifications for ogbn-arxiv, where we use a three-layer GCN with 256 hidden units and prune edges using cosine dissimilarity with a threshold 0.4, as the dataset has non-binary attributes.
SVD-GGN: Adversarial perturbations are filtered by using a low-rank approximation. For the model, we use the DeepRobust library.
We follow the settings in are trained with a learning rate of 0.01 and weight decay of 0.0001 using the ADAM optimizer. Each detector is trained on different adversarial samples generated through attacking a GCN classifier. threshold of 0. used, where edges with scores that exceed the threshold are detected Oft-st--Dsttiuuttion and pruned.
GOOD-AT:
20 MLP detectors with 64 hidden units
EvenNet: Two-layer MLP with 64 hidden units (256 for OGB-arXiv) for initial feature transformation. A total of = 10 is used with PPR initialization a 0.1. We use a dropout rate of 0.5 during training.
SoftMedianGIDCC The default configurations of Geisler et al. (2021) are used. Two-layer GDC with 64 hidden units, temperature T' = 0.2 for the SoftMedian aggregation, Personalized PageRank diffusion coefficent a = 0.15, and k 64 for sparsification. For OGB arBvarXiv, a three-layer GDC with 256 hidden units is used with T 5 and a 0.1.
C.2. Training settings
GPR-GAE is trained using the ADAM optimizer with a learning rate of 0.01 and a weight decay of 0.0001. Training is conducted for 2000 epochs. We create 10 validation edge sets by randomly inserting negative edges with = 0.3 i. Here, i indicates the i-th validation edge set. We evaluate the model every epoch by computing the mean AUC and mean AP across the 10 validation edge sets. The model with the best performance selected based on these metrics. When training the classifiers, maximum of 3000 epochs is used for training, using the Adam optimizer with learning rate of 0.01, weight decay of 0.001, and tanhMargin loss. An early stop method is used with patience of 200 epochs. For adversarial training, the first ten epochs are trained without adversarial examples.
For attack parameters in adversarial training, we use 20 epochs with no early stopping. The block size is million, and the loss type is tanhna For PRBCD, the learning factor is 100, while for LRBCD, the learning factor is 20 times that of PRBCD. When training, budget of 0.2 used.
15

---

Self-supervised Adversarial Purification for Graph Neural Networks
C.3. Choice of Hyperparaaeterrs of Attacks for Evaluation
For attack parameters in the evaluation stage, we use learning factor of 100 with 400 epochs. In the case PRBCD, 100 additional epochs are performed with decaying learning rate and without block resampling.
0.85
0.85
0.80
0.80
0.75
0.75
Accuracy
Accuracy
0.70
0.70
IKEE OK LOW Margin
0.65
LOW
0.65
Margin
BnntWargin
mehhdorgn
0.60
auMargin
0.60
duttargi
clean
0.1
0.75
0.5
clean
0.1
0.75
0.5
Attack Budget
Attack Budget
(a) GCN
(b) GAT
0.85
0.85
0.80
0.80
0.75
0.75
Accuracy
Accuracy
0.70
0.70
Mtek LoKe
Altart Lonk
0.65
0.65
Mangin
Magis
antMargin
berMMargi
duMaraan
duttargn
MCE
MCS
0.55
0.55
clean
0.1
0.75
0.5
clean
0.1
0.25
0.5
Attack Budget
Attack Budget
(c) GPRGNN
(d) APPNP
Figure C. The accuracy of GPR-GAF attached Vanilla (a) GCN, (B) GAT, (c) GPRGNN, (d) APPNP in Cora dataset against adaptive PRBCD attack for budgets 0 (clean), 0.1, e 0.25, e 0.5 using various attack loss types.
Given the differing mechanisms of adversarial purification and adversarial training methods in defending against attacks, the optimal hyperparameters for attacks may vary between these approaches. To determine effective attack hyperparameters for each defense strategy, we conduct grid search across eight loss types and block sizes of [10K, 50K, 250K], under an attack budget of 0.5. For adversarial purification methods, we select vanilla GPRGNN combined with our GPR-GAE as the representative model. For non-GPR -en--PR-GAE GAE methods, we select the adversarially trained (PRBCD) GPRGNN as the representative model.
Attack Loss Type. Figure C.I presents the accuracy of four GNN models combined with GPR-GAE's adversarial purification method across eight loss types with a block size of 10K on the Cora dataset. In contrast Gosch al. (2023). where the tanhMargin loss type is used for attacks, the Margin loss type consistently delivers the most effective attack performance across varying attack budgets GPR-GAE Consequently, GPR-GAF and the tanhMargin loss for attacks on other methods.
the Margin loss for adaptive attacks on
Block Size. For the PRBCD attack, we use a block size of 50K for PubMed and 10K for the other datasets across all defense methods. For the LRBCD attack on Cora, we use a block size of 10K on GPR-GAE while using a block size of 250K on the rest of the methods. Additionally, for large-scale dataset, OGB-arXiv, we exceptionally use block
16

---

Self-sperrvise Adversarial Purification for Graph Neural Networks
size of million.
D. Visualization of the Learned GPR Coefficients
1,000
1,000
0.305
0.24
08
0.007
0.505
GPR Filter Filterlnde Index
0.382
0.407
0.123
0.
GPR. Filter Index
1.254
0.653
0.755
Coofficiens Value
0.145
0.523
m-
4..31
0.41
.0.004
1:304
0.812
0.424
0.0
0.058
4.068
0.033
0.383
0.110
0.000
0.340
6.122
0.093
-9.2
0.146
0.263
-0221
0.071
0.376
0.011
0.122
0.039
0.270
0.032
0.045
0.161
0.240
0.078
0.011
0.020
0.078
0.130
0.062
0.058
0.003
0.279
0.126
002
1
2
Coefficient Index
Coefficient Index
(a) Cora
(b) Citeseer
1.000
1.000
0.567
0.687
0.5
0.462
0.731
GPR Filter Index
0.089
0.642
0.007
GPR lindex
00.00
0.470
0.510
0.6
Coafiiic Vilue
0.4
0.037
0.049
0.054
0.028
.0345
0.2
-0.180
-0.190
.0.005
0.281
-0.003
0.332
-1.0
0.123
00.363
-0.355
-0.006
0.568
0.372
0.0
0.364
0.224
0.600
0.204
0.009
0.026
0.380
0.054
0.288
0.251
-0.326
+0.07
00.32
0.206
-02
3.706
-04
7
Coefficient Index
Coefficient Index
(c) Cora ML
(d) Chameleon
1.25
1,000
GPR Filter Index
.0.022
.0.088
1,208
1.00
Voluee
GPR Filter Index
0.050
0.767
0.8
0.6
Coef Colfette Value
0.4
-0.014
0.578
6.631
0.067
0.318
4.298
-0.41
0.077
0.350
0.25
0.284
0.050
0.044
00233
0.807
0.00
+0.235
40.352
0.054
0.070
0.305
0.222
4.987
6.275
.0048
0.335
-0.25
0.167
-0.096
60.362
6.133
.0176
6.067
-0.036
0.336
-0.50
00.044
-0407
0.443
-0.992
0444
-0.274
0,625
-0.4
Coefficient Index
Coefficient Index
(e) Pubmed
(f) OGB-arXiv
Figure D.2. Visualization of the learned coefficients for each GPR filter GPR-GAE when trained for adversarial purification. For the coefficient value ".. indicates the GPR Filter Index (i-th GPR Filter) and j indicates the Coefficient Index (for j-th hop). We adjust the sign the values so that last coefficient values of each GPR filter are positive.
Figure D.2, we present the learned GPR coefficients for each of the GPR filters in GPR-GAE throughout the experiments when K 7. The coefficient Ys. controls the propagation neighborhood information j j-hops away for the i-th GPR filter, allowing for fine-grained adjustment of neighborhood contributions. In Chien al. (2021), the GPR coefficients in GPRGNN exhibit consistent signs in homophilic graphs, while fluctuating in heterophilic graphs like Chameleon, which have more complex graph structures. In contrast, the learned GPR coefficients in GPR-GAE generally display greater diversity regardless of their homophilic or heterophilic nature, efficiently regulating the inclusion or exclusion of neighborhood information. This enables the model to form distinct and unique neighborhood representations for each GPR filter with different neighborhood sizes. Furthermore, the coefficients demonstrate clear distinctions across various datasets, highlighting GPR-GA SPR-GAE's ability to adaptively learn appropriate neighborhood representations for each dataset, making a
17

---

Self-speervised Adversarial Purification for Graph Neural Networks
powerful data-driven approach.
E. Algorithms
Algorithm 1 Training of GPR-GAE
1: Input: Graph G = (A, X), perturbation budget (p, 9, 7),, model parameters 0, maximum epochs, validation data { vG }
2: Output: Trained GPR-GAE purifier fo
3: Initialize parameters 0
4: Set mest_va = -00
5: for epoch
maximum epochs do
6: Sample perturbed graph G' (A', X) from B(G, (p:g,)))
7: Predict adjacency matrix Å fo(G")
8: Compute total loss C
9: Update parameters 0 using gradient descent:
0 - VoL
10: Evaluate validation metric val.metri on {Gvat}
11: if val metric > best val metric then Update best_val metric f- val_metric Save model parameters 6*
12:
14:
end if
15:
end for
16: Return: Best trained purifier fo with parameters 0*
Algorithm 2 Multi-Step Purification with GPR-GAE
1: Input: Perturbed graph G' (A', X), trained purifier fo. step size a, terminal threshold GNN classifier f
2: Output: Node predictions from classifier fe
3: Initialize A = A'
4: for t = 0 to max_steps- do
5: Predict purified adjacency matrix (0) = (o) (c) X)
6: Compute purification direction:
AA Á (1)
7: Update adjacency matrix:
A (++1) ( (4)
if ||
8:
then
9:
Break
10: end if
end for
12: Set final purified adjacency matrix A the last updated adjacency matrix
13: Pass A to the GNN classifier fg
Return: Node predictions Y = f (A X)
18

---

Self-speervise Adversarial Purification for Graph Neural Networks
F. Ablation Studies
Table F2. Variations GPR-GAE and their explanations
Variation
Explanation
GPR-GAE
The original version of the model we use throughout the experiments.
w/o multi-step purification
Single-step adjacency matrix prediction, with discretization of edges using threshold 0.I. We 2-layered GCN for the node encoder.
w/o GPR filters
with self-loops
Instead of Ans. we A,, the normalized adjacency matrix with self-loops. Among three perturbation methods in training, we remove edge reweight process. reduced edge injection ratio p = 1.5 to 0.5, smaller training perturbation sample space. Reduced K = to K = 2, with smaller neighborhood boundary coverage.
w/o edge reweight
smaller training perturbation budget
w/o higher order dependencies
w/o multi step purification
with self-lops
edge reweight
smaller training perturbation budget-
wio higher order dependencies
0.68
0.69
0.70
0.71
0.72
0.50
0.55
0.60
0.65
Accuracy (Clean)
Accuracy (Attacked)
Figure F.3. Comparison of test accuracy for variations of GPR-GAE on Citeseer. The left figure shows accuracy under clean conditions, while the right figure illustrates accuracy under non con-adapiive PRBCD attack on vanilla GCN.
In this section, conduct ablation studies regarding GPR-GAE. We vanilla GCN as the classifier, attached with the variations of GPR-GAB in Table F.2, and compare accuracy under clean and transfer attacks (PRBCD, = 0.5) from vanilla GCN. Figure F.3 shows that, in general, the original variation of GPR-GAE that we use throughout the experiments achieves the best overall results. Exceptionally for the variation with no multi-step purification, achieves a better clean accuracy compared to the original. However, under adversarial scenarios, experiences relatively large drop of accuracy compared to the original variation with multi-step purification, showcasing the effectiveness of the continuous and gradual graph refinements against severe perturbations.
In the case of the variation without GPR filter, which indicates replacing the node encoder with two-layer GCN, it performs poorly, especially under adversarial attacks. This shows that the inevitable smoothing effect coming from the static neighborhood propagation scheme makes highly ineffective under attacks, falling short in distinguishing between the clean and the adversaries. The original variation shows better performance compared to the rest the other variations, benefiting from the non-self looped normalized adjacency matrix with more precise and distinctive control over each neighborhood propagation. learning more generalized purification directions with the edge reweight method, learning purification directions broader sample space using relatively large perturbation budget, and the higher order dependencies from the larger neighborhood boundary coverage.
G. Empirical Validation of Structural Encoding
To further extend the motivation presented in Section 3.3 and validate structural encoding capabilities, we conducted experiments identify existent 1-hop and 2-hop connections in inductive settings. This evaluation compares the
19

---

Self-supervised Adversarial Purification for Graph Neural Networks
GPR-GAE node encoder against three baseline node encoders: GCN, GraphSAGE, and GIN. For each node encoder, two separate edge encoders and decoders assigned, focusing respectively either 1-hop connections 2-hop connections.
In 1-hop prediction, positive samples are direct connections, while negatives are random non-connections. This task primarily evaluates the model's ability to capture proximity between node pairs. In 2-hop prediction, positives are two-hop paths, and negatives are direct connections without two-hop paths. This task goes beyond simple proximity, requiring the model distinguish between the two types relationships that are both proximal.
Task Definitions
I-Hop Prediction: Distinguish between C1+ and Ci-
Positive Samples (C1+): Direct connections the graph.
Negative Samples (C1-): Randomly selected non-connections of the same size as the positives.
2-Hop Prediction: Distinguish between C2+ and C2-,dir
Positive Samples (C2+): Connections formed by two-hop paths in the graph.
Negative Samples (C2-,du)) Direct connections that are not two-hop.
Negative Samples (C2-); Randomly selected non-two-hop connections the same size as the positives.
Setup
Nodes were split into 80% for training, 10% for validation, and 10% for testing. Connections in validation (Caa)) and testing (Crea) included least one validation or test node, ensuring these connections were not exposed during training.
Inductive Split:
Training: The node encoder and both edge encoder-decoder pairs are trained jointly part of unified model. We use ADAM optimizer with learning rate of 0.01 and weight decay of 0.00005.
First Edge Encoder/Decoder:
Positive train connections (C++): Direct connections in the training graph.
Negative train connections (Ci-): Random non-connections in the training graph.
Loss: Binary Cross-Entropp (BCE) loss C1+ and C1
Secoond Edge Encoder/Deccoler:
-
Positive train connections (C2+): Two-hop connections in the training graph.
Negative train connections (C2-,dir): Direct connections that are not two-hop.
Negative train connections 2 (C2-): Random non-two-hop connections.
Loss: Combined BCE loss C2+, C2-,dirs and C2_.
Validation:
Validation connections (Ci+.val C1-yaal O2t C2- dir, vai) similarly defined but included at least one valida- tion node in each connection.
-Performance was evaluated by summing the AUC across both 1-hop: (Ci+, C1- and 2-hop:
(C2+,sal, C2- dir, vat).
-The model with the highest combined score was selected.
Testing:
Test connections (C1+,teat: C1-,tett C2+ C2- dir, ust) followed the same definitions, with at least one test node in each connection.
Performance was evaluated by the AUC across both 1-hop: (C1+ C1 ves) and 2-hop: (C2+.ess C2- dir, teat).
particular, for the 2-hop prediction task, the objective evaluate the model's ability differentiate between two types of connections, both of which considered proximal, they connect nodes within relatively short range of 2-hops.
20

---

Self-supervised Adversarial Purification for Graph Neural Networks
2 hop,
2 h-hop, K-/
hop, K-2
1-hop, h-hp,
2-hop,
0.9
0.9
AUC
ALC
0.7
0.6
0.6
hep 2000
hep
Shep
1as 2 GraphSAGE
GPR.GAE
Models
Models
(a) Cora
(b) Citeseer
Figure G.4. AUC for existent 1-hop and 2-hop link identification using different GAE models
Results
Results in Figure G.4 demonstrate that GPR-GAE achieves the highest AUC scores in both 1-hop and 2-hop prediction tasks for K = 2 and K 7. Unlike traditional GAE architectures, GPR-GAE exhibits consistent performance improvement as K increases, showcasing its ability to fully leverage higher-order dependencies while mitigating oversmoothing. Moreover, GPR-GAE significantly outperforms traditional GAEs in the 2-hop prediction task. This highlights the advantage of its unique multiscale neighborhood representations, which are derived from distinctively stored outputs GPR filters. These representations enable GPR-GAE to better model complex relationships, such as C2+ and C2-,dir simply encoding proximal connections. Consequently, the demonstrated results form robust foundation for tasks such as adversarial purification that require advanced structural capabilities.
.dir tests moving beyond
21


Reviews:
[{"review_id": "lZ1LsKHF06", "reviewer": "Reviewer_kPxh", "summary": "This study introduces a self-supervised adversarial purification framework to enhance the robustness of GNNs against attacks. Unlike traditional methods that merge accuracy and robustness in a single classifier, their approach (GPR-GAE) employs a dedicated purifier to cleanse input data prior to classification. Experimental results show that GPR-GAE achieves  promising results.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thoughtful and constructive comments regarding our work. We would like to address your concerns (C) with the following responses:\n\n---\n> **C1.** The authors should further elaborate on the connections to existing work on GNNs with spectral filtering (a.k.a. spectral GNNs).\n\nWe thank the reviewer for the suggestion. Among spectral GNNs with learnable coefficients—such as ChebNet [6], BernNet [7], and GPRGNN—we build on GPRGNN due to its expressiveness and flexibility. Unlike ChebNet and BernNet, which use fixed polynomial bases, GPRGNN leverages learnable coefficients over a monomial basis, enabling unconstrained adaptation to diverse spectral responses.\n\nWe extend this by employing multiple GPR filters in parallel, each with independently learned coefficients, and concatenate their outputs. This design captures a wider range of spectral behaviors, enhancing generalization under structural perturbations.\n\nAdditionally, we omit self-loops by using the normalized adjacency $\\tilde{A}_{ns} = D^{-1/2} A D^{-1/2}$, which preserves spectral properties. Since self-loops suppress high-frequency components, excluding them helps retain fine-grained variations crucial for tasks sensitive to local structure. As shown in Figure F.3, this improves purification under adversarial conditions.\n\n|Filters|Cora|Citeseer|\n|-|-|-|\n|Chebnet[6]|68.3±2.8| 63.8±2.9 |\n|Bernet[7]|67.6±3.1| 62.9±3.0 |\n|GPR (Ours)|69.7±2.9|64.1±2.4|\n\nUnder adaptive PRBCD attack ($\\epsilon = 0.25$), our GPR-based filters show higher robustness than ChebNet and BernNet, confirming the benefit of its flexible, unconstrained design.\n\n\n\n---\n> **C2.** The paper adopts a node-wise filtering strategy but lacks sufficient discussion of related node-wise spectral filtering methods (e.g., [2–5]) \n\nWe thank the reviewer for this observation. While our method shares some perspective with node-wise filtering—particularly in leveraging multiple filters to capture diverse structural signals—we emphasize that GPR-GAE takes a fundamentally different approach by using shared global filters instead of assigning unique filters per node. Recent works [2–5] propose node-wise filtering, adapting filter parameters locally based on each node’s structural context. While expressive, this approach is highly vulnerable to adversarial settings: localized attacks that perturb neighborhoods can distort the context for node-specific filter selection, leading to unreliable or misleading outcomes.\n\nIn contrast, GPR-GAE employs multiple global GPR filters applied uniformly across the graph. These filters are trained to generalize over a wide range of structural patterns, offering inherent robustness to localized noise. Concatenating these globally learned filters yields a rich spectrum of responses without requiring per-node adaptation, avoiding amplification of adversarial perturbations.\n\n---\n> **C3.** Discussion related to [1].\n\nWe appreciate the reviewer’s insightful suggestion. The theoretical insights in [1] align well with our training strategy. First, [1] observes that structural attacks shift homophilic graphs toward heterophily, emphasizing the value of heterophil-aware robustness. Our self-supervised training strategy injects a large ratio of negative edges—unlike prior GAEs—exposing the model to heterophilous patterns even on homophilic graphs, and further discussed in Figure D.2. Second, [1] advocates separating ego- and neighbor-embeddings. As discussed in Section 4.1, our encoding concatenates representation $H_{\\theta_k}$ from distinct GPR filters, with $H_{\\theta_0}$ explicitly set to $H^{(0)}$—the initial node embedding—preserving ego-information throughout purification. This design enhances robustness by preserving self-information from potentially corrupted neighborhoods. Under adaptive PRBCD attack ($\\epsilon = 0.25$), removing self-information from the concatenation results in a performance drop of $2.4$% on Cora and $1.2$% on Citeseer, validating its contribution to robustness.\n\n---\n> **C4.** While a complexity analysis is included, it is suggested that the authors also provide empirical results.\n\n| Model | Train(per epoch) | Inference($ \\epsilon=0.25 $) |\n|-|-|-|\n| GOOD-AT | 2744.9ms | 16.2ms |\n| GPR-GAE | 65.6ms | 87.2ms |\n\nThe table compares GPR-GAE with the recent purification baseline, GOOD-AT, on Cora, reporting average training time per epoch and inference time under PRBCD attack ($\\epsilon = 0.25$) using GCN as the classifier. GPR-GAE trains much faster (65.6 ms vs. 2744.9 ms). While its inference time (87.2 ms) is higher, it remains practical. GOOD-AT’s cost stems from adversarial sample generation. For reference, inference with standalone GCN takes 8.5 ms, showing GPR-GAE adds minimal overhead for substantial robustness gains.\n\n---\n\n[6] Convolutional Neural Networks on Graphs with Fast Localized Spectral Filtering\n\n[7] BernNet: Learning Arbitrary Graph Spectral Filters via Bernstein Approximation", "claims_and_evidence": "yes", "methods_and_evaluation_criteria": "yes", "theoretical_claims": "yes", "experimental_designs_or_analyses": "yes", "relation_to_broader_scientific_literature": "(1) graph neural networks (2) robustness (3) generalization", "essential_references_not_discussed": "[1] How does heterophily impact the robustness of graph neural networks? theoretical connections and practical implications\n\n[2] Graph neural networks with diverse spectral filtering\n\n[3] Node-oriented spectral filtering for graph neural networks\n\n[4] Node-wise filtering in graph neural networks: A mixture of experts approach\n\n[5] Node-wise localization of graph neural networks", "other_strengths_and_weaknesses": "**Strengths:**\n\n1. The research questions addressed in the paper and the authors' designs are both well-motivated.\n2. The experimental analysis, enhanced by visualization, is thorough and comprehensive.\n3. The paper is well-written and easy to follow.\n\n**Weaknesses:**\n\n1. The authors should further elaborate on the connections to existing work on GNNs with spectral filtering (a.k.a. spectral GNNs).\n2. While the authors employ a node-wise filtering approach in their method, they fail to discuss similar works extensively. It is recommended that they consider and engage with relevant literature, such as [2, 3, 4, 5], and select appropriate methods to strengthen their baseline comparisons in the experimental section.\n3. This work primarily focuses on the robustness of GNNs, employing spectral filtering as a solution. However, the use of the GPR filter (adaptive filter) is closely tied to the issue of graph heterophily. The authors are encouraged to review the work cited as [1] and provide a more in-depth discussion within this context to enhance the impact of their work in the field.\n4. While a complexity analysis is included, it is suggested that the authors also provide empirical results.\n\n[1] How does heterophily impact the robustness of graph neural networks? theoretical connections and practical implications\n\n[2] Graph neural networks with diverse spectral filtering\n\n[3] Node-oriented spectral filtering for graph neural networks\n\n[4] Node-wise filtering in graph neural networks: A mixture of experts approach\n\n[5] Node-wise localization of graph neural networks", "other_comments_or_suggestions": "See the weakness part in \"Other Strengths And Weaknesses\".", "questions_for_authors": "See the weakness part in \"Other Strengths And Weaknesses\".", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "c31HyuMnEy", "reviewer": "Reviewer_BFFi", "summary": "Traditional defense strategies for Graph Neural Networks (GNNs), such as adversarial training, often struggle to balance accuracy and robustness, as they entangle these competing objectives within a single classifier. This paper challenges that approach and introduces a novel self-supervised adversarial purification framework designed to decouple robustness from classification. By incorporating a dedicated purifier that preprocesses input data before classification, the proposed method ensures enhanced resilience against adversarial attacks. Experimental results across multiple datasets and attack scenarios highlight its state-of-the-art robustness, positioning it as an adaptable, plug-and-play solution for fortifying GNN classifiers.\n\n## update after rebuttal\n\nThe primary concern with this paper is its novelty. Prior to the rebuttal, my stance leaned toward a Weak Reject. During the rebuttal phase, the authors provided some reasonable evidence to support their contributions. However, I still have remaining concerns regarding the novelty of the work. Taking these points into account, I would like to maintain a **Neutral position**. I do **not lean strongly toward either acceptance or rejection during the AC and reviewer discussion phase.**", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thoughtful and constructive comments. We address your concerns (C) as follows:\n\n---\n\n> **C1.** The core idea closely resembles test-time graph transformation [1].\n\nWe understand the concerns regarding resemblence with TTGT[1] and wish to highlight four key differences:\n\n1. Dedicated Parameter Training\nTTGT leverages embeddings from a pretrained classifier and **avoids additional training**. It performs test-time transformation by optimizing a surrogate loss tied to the classifier via Projected Gradient Descent-an approach that closely resembles PGD-style attacks. In contrast, **our method introduces a dedicated purification module trained on the training graph**, which **performs purification via learned inference, independently of the classifier**.\n\n2. Purification Steps\nOur framework performs **multi-step, continuous purification**, enabling gradual refinement and better resilience to severe perturbations. TTGT, by comparison, uses a **single-step discrete projection**. Our iterative purification process differs not only from TTGT but also from other purification approaches.\n\n3. Theoretical Focus\nTTGT minimizes a surrogate loss approximating class-conditional entropy H(Z|Y). Its guarantee (Theorem 2 in [1]) assumes that class-conditional means ($c_k$) approximate the true distribution—**an assumption that breaks under adversarial attacks**, which distort feature distributions. Hence, **TTGT is more suitable for mild domain shifts, as reflected in the nature of follow-up works that cite it**.\n\n4. Purification Budget\n**TTGT uses a fixed edge-flip budget** like attacks, limiting its adaptability. In contrast, **our method learns adaptive, continuous multi-step updates without a predefined budget**, improving robustness across varying attack strengths.\n\n---\n\n> **C2.** GPR‑GAE lacks technical novelty, Using GAE as a noisy edge predictor is well‑established [2,3].\n\nGPR-GAE introduces both **architectural and conceptual novelties** over GPRGNN. While GPRGNN uses a single set of learned propagation coefficients for supervised classification, GPR-GAE employs multiple distinct GPR filters, each with its own propagation weights, concatenated to capture **diverse multi-scale neighborhood patterns**. We also exclude self-loops to better highlight meaningful structural signals. These design choices explicitly aim to enhance the model’s structural capability to distinguish clean from adversarial structures, as empirically validated in Figure G.4.\n\nUnlike prior GAE-based defenses such as [3, 5], which rely on additional heuristic pre-processing (e.g., feature similarity) before applying GAE based denoising like [2], GPR-GAE is **fully data-driven** with its enhance structural capabilities, learning to purify adaptively without relying on such assumptions.\n\nMoreover, while most existing self-supervised defense methods like [3, 5] focus on the poisoning setting, our work addresses the underexplored area of self-supervised defense in the evasion setting with different challenges—applying a targeted self-supervised framework to this context and introducing an additional point of novelty.\n\nFinally, although GPR-GAE utilizes similar loss as the conventional GAEs, its core focus lies in **learning purification directions in a continuous space** via edge re-weighting, effectively leveraging the train graph to enable more precise and generalizable purification on the test stage attacks.\n\n---\n\n> **C3.** Comparison with [1,2,3] and other adversarial training.\n\nWe acknowledge the relevance of [1,2,3] and include them in our comparison below. However, some's core assumptions differ from ours, which limits direct comparability.\n\n[3] builds on SuperGAT [2] with the rest of the methodology tailored for the poisoning problem setting. Since our work focuses on the evasion setting, we represent both [2,3] as $SuperGAT_{MX}$ [2] for comparison. Also, we evaluate $TTGT_{GCN}$ [1] using a 25% purification budget, matching the perturbation level of the non-adaptive PRBCD attack used in the following table, to reflect its best-case performance in our setup.\n\n|Model|Cora|Citeseer|\n|-|-|-|\n|$GCN$ (For comparison)|46.9±1.5|40.0±2.3|\n|$TTGT_{GCN}$ [1]|49.6±2.0|44.2±2.1|\n|$SuperGAT_{MX}$ [2,3]|54.6±4.6|46.4±1.7|\n|$GPR\\text{-}GAE_{GCN}$|75.1±2.7|68.7±3.1|\n\nWhile [1,2,3] offer valuable contributions, their focus on different problem settings limits their robustness under our evaluation scenario.\n\nPlease see our response to Reviewer \"ShLW\" (C2) for concerns on the adversarial training baselines.\n\n---\n\n> **C4.** Qualitative results would be beneficial.\n\nFigure D.2 provides qualitative insights by visualizing the learned GPR coefficients, which exhibit diverse, dataset-specific propagation patterns. This highlights GPR-GAE's capabilities of adaptive purification, leading to improved performance across various datasets.\n\n---\n\n[5] Reliable Representations Make A Stronger Defender: Unsupervised Structure Refinement for Robust GNN", "claims_and_evidence": "Yes.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "No discussions.", "experimental_designs_or_analyses": "See Other Strengths And Weaknesses.", "relation_to_broader_scientific_literature": "Contributing to various scientific GNN applications.", "essential_references_not_discussed": "See Other Strengths And Weaknesses.", "other_strengths_and_weaknesses": "### Pros\n\n- The paper addresses an important problem with a clear motivation and concrete analysis.\n- The writing is well-structured and clear.\n- Extensive experiments support the effectiveness of the proposed approach.\n\n---\n\n### Cons\n\n- Concerns regarding novelty\n   - The core idea of separating the graph purifier and classifier under an evasive setting closely resembles test-time graph transformation [1]. \n   - The proposed GPR-GAE lacks technical novelty. Using GAE as a noisy edge predictor is a well-established approach [2,3], and simply replacing the GCN layer with GPR-GNN does not introduce significant innovation.\n   - I strongly encourage the authors to discuss these concerns in detail.\n- Lack of baseline comparisons\n   - The paper should include comparisons with [1,2,3]. Additionally, several adversarial training-based robust GNN methods, such as [4], should be considered as baselines.\n\n- Lack of qualitative analysis\n   - Providing qualitative results demonstrating how the proposed method enhances performance would be beneficial.\n\n---\n\n### References\n[1] Empowering Graph Representation Learning with Test-Time Graph Transformation\n\n[2] How to Find Your Friendly Neighborhood: Graph Attention Design with Self-Supervision\n\n[3] Self-Guided Robust Graph Structure Refinement\n\n[4] Adversarial Graph Contrastive Learning with Information Regularization", "other_comments_or_suggestions": "See Other Strengths And Weaknesses.", "questions_for_authors": "See Other Strengths And Weaknesses.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "trGu4M1ZWt", "reviewer": "Reviewer_ShLW", "summary": "This paper studies the robustness of GNNs against adversarial attacks from the perspective of adversarial purification. The authors introduce a self-supervised adversarial purification framework that preprocesses input data to remove adversarial perturbations before classification. Experimental results on a wide range of graph datasets demonstrate that the proposed method achieves state-of-the-art robustness while maintaining high accuracy. Overall, the proposed approach offers a promising direction for improving adversarial robustness in GNNs without compromising classification accuracy.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thoughtful and constructive comments. We would like to address your concerns (C) with the following responses:\n\n---\n\n> **C1.** The claim in Proposition 3.1 is clear. However, according to Proposition 3.1, with a deep GNN (e.g., when the number of layers ≥ 3), most nodes in the graph will be affected. My question is, in such a case, does the robustness term become the dominant term in the loss function? If so, will this affect the model’s accuracy?\n\nAs you noted, with increased depth, more nodes are affected by perturbations, which could overemphasize the robustness term in conventional adversarial training. This overemphasis can indeed lead to a drop in accuracy due to the model learning mostly from fundamentally corrupted data. This consideration is precisely why we advocate for decoupling accuracy and robustness in our self-supervised adversarial purification framework. The decoupling ensures neither objective overshadows the other, preventing performance degradation. We appreciate you highlighting this important architectural consideration!\n\n---\n\n> **C2.** Many adversarial training methods are cited but not compared in the experiments.\n\nTo the best of our knowledge, [1] is the most recent published work on adversarial training in Graph Neural Networks (GNNs). Notably, it is the first to explicitly address the validity-related limitations of previous adversarial training in the transductive setting, as mentioned in Section 2.1. We therefore focus our comparison on this state-of-the-art approach.\n\n| Model | Cora | Citeseer |\n|---|-|---|\n| $S^2GC$ [2] |52.3±3.4|50.2±3.6|\n| $GPRGNN$ [1] |71.4±3.0|65.7±4.4|\n| $GPR\\text{-}GAE_{GCN\\_{Vanilla}}$ | 75.1±2.7|68.7±3.1|\n\nThe table further supports our choice of baseline by reporting the performance of $GPR\\text{-}GAE_{GCN\\_Vanilla}$ and [1] with GPRGNN as backbone under a non-adaptive PRBCD attack with $\\epsilon = 0.25$ in an inductive setting. We also include a previous adversarial training method [2], evaluated with its best-performing backbone, $S^2GC$. Although [2] demonstrates strong results against other adversarial training methods under the transductive setting in its original paper, it significantly underperforms compared to the adversarial training baseline we use [1] under our inductive setup.\n\n---\n\n> **C3.** Larger datasets, such as OGBN-MAG or OGBN-Products, are needed to demonstrate the scalability of the proposed defense.\n\nWe follow prior works on adversarial robustness, which commonly use OGBN-Arxiv as the largest-scale benchmark. For further demonstration, we evaluate the scalability of GPR-GAE on OGBN-Products, which has over 10× more nodes and 50× more edges than OGBN-Arxiv. Due to PRBCD and LRBCD attacks running out of memory on OGBN-Products, we use DICE [3], a non-gradient based attack, to demonstrate the scalable robustness of GPRGAE in the following table.\n\n|Model|Clean| $ \\epsilon = 0.1 $ | $ \\epsilon = 0.25 $ | $ \\epsilon = 0.5 $ |\n|-|-|-|-|-|\n| $ GCN\\_{Vanilla} $ |73.7±1.8|68.3±2.4|62.7±2.0|55.9±2.6|\n| $GPR\\text{-}GAE_{GCN\\_{Vanilla}}$ |73.4±2.3|71.5±3.1|69.7±2.5|68.4±2.4|\n\nThe results indicate that GPR-GAE not only scales efficiently to significantly larger datasets like OGBN-Products but also maintains robust performance under adversarial conditions.\n\n---\n\n> **C4.** Although the proposed method can serve as a plug-and-play purification module for various GNN architectures, it is expected to introduce additional computational overhead. The authors should discuss the complexity of the proposed method to evaluate whether it is justified as a purification module.\n\nOur multi-step purification process introduces at most a linear overhead, regardless of the GNN classifier architecture used. As detailed in Section 5.4 and Section B, while a K-layer GCN has a node encoding complexity of $O(K · |E| · Z)$, our purification module incurs an extra $O(K · |E| · Z^2)$ cost over a small fixed number of purification steps. This additional cost scales linearly with the number of edges and,in our view, is justifiable by the substantial improvements in adversarial robustness achieved by our method across diverse classifers. For empirical evidence, please refer to our response to Reviewer \"kPxh\" (C4).\n\n\n---\n> **C5.** The proposed method is effective against evasion attacks, but how does it perform against poisoning attacks?\n\nThank you for raising this important point. Our methodology focuses on evasion attacks, as our aim is to address theoretical limitations of adversarial training, which is primarily explored in the evasion setting. While GPR-GAE is not explicitly designed for poisoning, its self-supervised, model-agnostic framework offers potential for extension—an exciting direction for future work.\n\n---\n\n[1] Adversarial Training for Graph Neural Networks: Pitfalls, Solutions, and New Directions\n\n[2] Spectral Adversarial Training for Robust Graph Neural Network\n\n[3] Adversarial Attacks on Graph Neural Networks via Meta Learning", "claims_and_evidence": "The claims made in the submission are generally well-supported by convincing evidence.", "methods_and_evaluation_criteria": "There are missing comparison with adversarial training based graph defense methods", "theoretical_claims": "The claim in Proposition 3.1 is clear. However, according to Proposition 3.1, with a deep GNN (e.g., when the number of layers ≥ 3), most nodes in the graph will be affected. My question is, in such a case, does the robustness term become the dominant term in the loss function? If so, will this affect the model’s accuracy?", "experimental_designs_or_analyses": "See Weaknesses and Questions below.", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "Pros:\n\n- The motivation of defending GNNs against adversarial attacks using a purification module is reasonable.\n- The idea of decoupling the learning objective of adversarial training into accuracy and robustness terms is interesting and technically sound.\n- Experimental results demonstrate the effectiveness of the proposed method compared to baselines.\n\n\n\nCons:\n\n- Many adversarial training methods are cited but not compared in the experiments.\n- Larger datasets, such as OGBN-MAG or OGBN-Products, are needed to demonstrate the scalability of the proposed defense.\n- Although the proposed method can serve as a plug-and-play purification module for various GNN architectures, it is expected to introduce additional computational overhead. The authors should discuss the complexity of the proposed method to evaluate whether it is justified as a purification module.", "other_comments_or_suggestions": "N/A.", "questions_for_authors": "- The proposed method is effective against evasion attacks, but how does it perform against poisoning attacks?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "EIvlMBhRIA", "reviewer": "Reviewer_BjpG", "summary": "The paper proposes a method to defend GNNs that is based on a separate GNN classifier and a purifier. The main idea is to decouple the classifier and purifier and learn a multi-step purifier using generalized pagerank. Extensive experiments are provided showing that this approach outperforms state-of-the-art defenses or purification methods.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thoughtful and constructive comments. We would like to address your concerns (C) with the following responses:\n\n---\n\n> **C1.** Aren't the static approaches such as Jaccard-GCN or SVD-GCN also already \"decoupled\"?\n\nUnlike Jaccard-GCN and SVD-GCN, which apply fixed heuristics for preprocessing, our contribution explicitly motivates **decoupled learning**: the purifier (GPR-GAE) independently learns graph reconstruction via a self-supervised objective, while the classifier focuses solely on accuracy. Thus, we advocate decoupling not merely in preprocessing steps, but crucially within the learning process itself.\n\n\n---\n> **C2.** Claiming a perfect balance of both trade-off terms would require more extensive also theoretic study.\n\nWe thank the reviewer for highlighting this point. To clarify, when we say \"overcome\" in abstract, we refer to the constraints of traditional methods intertwining accuracy and robustness within one classifier. Proposition 3.1 theoretically decomposes these conflicting objectives, motivating our design of specialized modules that independently handle each—especially robustness. While we fully agree that claiming a perfect balance requires further theoretical study, our empirical results show a substantial improvement in **mitigating** the trade-off. We will ensure this nuance is clearly articulated in future revisions.\n\n---\n> **C3.** Sec 2.2 one could be explicit about what the expectation over is meant.\n\nWe thank the reviewer for the advice and will explicitly state that the expectation in Sec 2.2 refers to the empirical risk over nodes in the given graph.\n\n---\n> **C4.** Given a fixed perturbation Proposition 3.1 holds true. However, during the attack generation for adversarial training, each iteration will have different $V_{\\text{unaffected}}$ and $V_{\\text{affected}}$.\n\nWe thank the reviewer for this insightful remark. To clarify the notation, we will explicitly denote the node sets as $V_{\\text{unaffected}}^{G'}$ and $V_{\\text{affected}}^{G'}$ to reflect their dependence on each perturbation $G'$ generated during adversarial training. Importantly, this notation refinement does not affect our core claim: each training iteration still highlights the inherent tension between accuracy and robustness, reinforcing our rationale for decoupling these conflicting objectives into separate specialized modules.\n\n---\n> **C5.** Could you clarify the Lipschitzness of your proposed updating scheme? Crucially, Thm. 3.2 requires $L < 1$.\n\nThis is a valuable question that we are happy to clarify. The Lipschitz condition $L < 1$, required by Theorem 3.2 for convergence of the purification update scheme, is encouraged by our training objective: minimizing $\\mathcal{L}(\\theta) = \\ell(f_{\\theta}(G'), G)$, where $G'$ is a perturbed version of the clean graph $G$. Since $G$ is fixed during training and the model learns to satisfy $f_{\\theta}(G) \\approx G$, the loss encourages the condition $\\||f_{\\theta}(G') - f_{\\theta}(G)\\|| < \\||G' - G\\||$, i.e., $f_{\\theta}$ behaves as a contraction mapping around $G$, approximating a Lipschitz constant $L < 1$ under a sufficient perturbation budget. This ensures stable and convergent updates in the multi-step purification process, as required by Theorem 3.2.\n\n---\n> **C6.** Additional experiment on WikiCS and Cora (Table 2)\n\n| Model | WikiCS (clean/0.25/0.5) | Cora (clean/0.25/0.5) |\n|--|-|-|\n| GCN (Vanilla) |75.0 / 29.0 / 24.5| 79.4 / 46.9 / 29.3|\n| EvenNet  | **76.7** / 35.8 / 31.9| **81.4** / 65.9 / 56.4 |\n| SoftMedianGDC| 73.5 / 33.5 / 30.7 | 77.4 / 62.3 / 53.6|\n| Jaccard-GCN | 73.4 / 58.8 / 52.5 | 78.5 / 64.1 / 50.9 |\n| SVD-GCN | 73.0 / 42.3 / 36.9 | 77.2 / 64.8 / 50.2 |\n| GOOD-AT | 74.1 / 58.7 / 51.2 | 77.7 / 65.4 / 61.0 |\n| **$GPR\\text{-}GAE_{GCN\\text{-}Vanilla}$** |75.1 / **66.8 / 63.0** | 79.4 / **75.1 / 72.6** |\n\n---\n> **C7.** How many random seeds?\n\nWe used 5 random seeds across all experiments.\n\n---\n> **C8.** Seems to have many hyperparameters.\n\nAlthough our method involves several hyperparameters, we deliberately keep most of them fixed across all datasets, demonstrating that our approach generalizes well without extensive tuning.\n\n---\n> **C9.** Is the edge injection step a uniform sampling from the complementary edge set?\n\nYes, the edge injection step involves uniform sampling from the set of non-existent edges $\\mathcal{E}^C$. Specifically, we first calculate the number of edges to inject as $|\\mathcal{E}_{\\text{inject}}| = p \\cdot |\\mathcal{E}|$, and then uniformly sample this number of edges from $\\mathcal{E}^C$ for injection.\n\n\n---\n> **C10.** Make explicit if the $L_{restore}$ is maximized or minimized.\n\nThank you for the correction — you are absolutely right. The current loss formulation is misleading as it implies maximization, which contradicts our intended objective of minimizing the restoration loss. We appreciate your correction, and we will adjust the sign and clarify the explanation in the revision.", "claims_and_evidence": "Most of the major claims are well supported. However, I feel some claims are rather vaguely supported / evidenced.\n\n**(I)** They claim to contribute a decoupling into two components: a classifier for accuracy and a purifier to restore graph structure. But aren't the static approaches such as Jaccard-GCN or SVD-GCN also already \"decoupled\" in the sense of first preprocessing the graph and then applying a GNN on top?  \n**(II)** In the abstract, the method is framed as a solution to overcome the robustness-accuracy tradeoff. While empirically the trade-off seems slightly better than in the compared to methods, claiming a perfect balance of both would require more extensive also theoretic study.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "I checked the correctness of all theoretical claims and went through the proofs in the Appendix.\n\n**Issues**\n\n**(I)** Sec 2.2 one could be explicit about what the expectation over is meant. E.g. the general objective is to minimize the expected loss over the distribution of graphs that could be sampled conditioned on the already given graph. However, for Proposition 3.1 to hold e.g., the empirical risk is used, as this is the one that can actually be used for training a model on a concrete dataset. This is no criticism that the empirical risk is used, just that one could be explicit in the main draft.  \n**(II)** Given a fixed perturbation Proposition 3.1 holds true. However, during the attack generation for adversarial training, each iteration will have different $\\mathcal{V}_\\text{unaffected}$ and $\\mathcal{V}_\\text{affected}$. Thus, while I do understand the motivation for the approach, I'm not 100% convinced of the argumentation. But as it is \"just\" a motivation, this may be enough.  \n**(III)** Could you clarify the Lipschitzness of your proposed updating scheme? Crucially, Thm. 3.2 requires $L < 1$.", "experimental_designs_or_analyses": "Yes, all experiments/analyses in the main draft.\n\n## Strengths\n\n* Follow state-of-the-art evaluation protocols for evasion attacks (e.g., inductive setting)\n* I really like Table 1. The number of experiments and comparisons per dataset are impressive. They clearly show the effectiveness of GPR-GAE compared to adversarial training and other robust GNNs.\n* Ablation study on the many design choices provided.\n* Code provided.\n\n## Weaknesses\n\n**(I)** As all homophilic datasets are citation datasets, I would be curious about the performance on a homophilic non-citation datasets e.g. WikiCS.   \n**(II)** Given Cora is the main dataset for a detailed comparison between methods in the main draft, I would have expected Table 2 to include the Cora dataset (or that other purification methods have also been employed on Cora).  \n**(III)** All results are presented with standard deviations but I can't find a description about how many random seeds have been used.", "relation_to_broader_scientific_literature": "The work contributes a superior purification method compared to previous static approaches. Furthermore, they show that their approach outperforms state-of-the-art defenses.", "essential_references_not_discussed": "I do think that all essential references are discussed.", "other_strengths_and_weaknesses": "## Weaknesses\n\n* The method seems to have many hyperparameters, e.g. $\\tau, p, q, \\eta, \\delta$, #purification steps and other design decisions. However, the authors provide ablations.", "other_comments_or_suggestions": "See questions.", "questions_for_authors": "* Is the edge injection step a uniform sampling from the complementary edge set? Furthermore, please make explicit how you sample from $\\mathcal{E}^C$.\n* Make explicit if the $L_\\text{restore}$ loss is maximized or minimized. Furthermore, as far as I understood how $L_\\text{restore}$ is currently defined in the text it should be maximized so as to make sense (minimization would be trivial bei outputting an $A_{ij}$-prediction around $0$ for an $\\{i,j\\} \\in \\mathcal{E}$ and that is exactly not what we want). However, $L_\\text{sym}$ should be minimized. Thus, $L_\\text{restore}+\\delta L_\\text{sym}$ doesn't make sense with the current definitions. Is there a sign-error in the current presentation?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The proposed approach is well-motivated. The main ideas (purification, decoupling) are interesting and sound. Importantly, as pointed out by Reviewer BjpG, the paper follows the state-of-the-art evaluation protocols for evasion attacks (e.g., adaptive attacks in the inductive setting). Several reviewers praised the comprehensiveness of the experimental evaluation. In the rebuttal, the authors provided additional experimental results which further strengthen the claim that the proposed approach improves robustness. However, I agree with Reviewer BjpG that the authors need to be more careful with claims regarding the accuracy vs. robustness trade-off, and carefully revise the paper to avoid over-claiming. 

In my opinion, the issues raised by Reviewer ShLW who recommends a weak reject have been sufficiently addressed in the rebuttal, even though the reviewer did not update their score. Specifically, addressing baselines the authors explained again the validity-related limitations of adversarial training and why they only compare to GPRGNN. They also added a comparison to S2GC which underperforms in an inductive setup. The authors also added an additional experiment on the larger OGBN-Products dataset, although only using the DICE attack, claiming memory issues. I suggest that the authors include such larger scale experiments in the final version using scalable attacks followiing the setup in [1] which also report result on OGBN-Products using only 32 GB. Finally, the authors explained that the computational overhead is not significant.

The main remaining issue raised by Reviewer BFFi who also recommends rejection was novelty. However, after the rebuttal the reviewer holds a neutral position. In my opinion there is sufficient novelty. Still, the connections to test-time graph transformation raised by the reviewer are valid and I encourage the authors to include this discussion in the updated version of the paper. 

Since Theorem 3.2 relies on having a Lipschitz constant L < 1, the authors should at least attempt to empirically verify whether this condition holds. Moreover, they should discuss what are the implications for their method (in theory and in practice) when this condition does not hold. While the loss indeed may encourages the condition, it is not clear whether it is actually enforced in practice. 

Taking everything into consideration, I recommend the paper to be accepted.

References:
1. Geisler et al. "Robustness of graph neural networks at scale"
Decision: Accept (poster)