Enhancing Robustness of Graph Neural Networks on Social Media with Explainable Inverse Reinforcement Learning
Authors: Yuefei Lyu
Chaozhuo Li
Sihong Xie
Xi Zhang
Venue: NeurIPS 2024 spotlight (2024)
Keywords: graph adverisarial attack
reinforcement learning
inverse reinforcement learning
graph neural networks
Primary area: graph_neural_networks

Abstract: Adversarial attacks against graph neural networks (GNNs) through perturbations of the graph structure are increasingly common in social network tasks like rumor detection. Social media platforms capture diverse attack sequence samples through both machine and manual screening processes. Investigating effective ways to leverage these adversarial samples to enhance robustness is imperative. We improve the maximum entropy inverse reinforcement learning (IRL) method with the mixture-of-experts approach to address multi-source graph adversarial attacks. This method reconstructs the attack policy, integrating various attack models and providing feature-level explanations, subsequently generating additional adversarial samples to fortify the robustness of detection models. We develop precise sample guidance and a bidirectional update mechanism to reduce the deviation caused by imprecise feature representation and negative sampling within the large action space of social graphs, while also accelerating policy learning. We take rumor detector as an example targeted GNN model on real-world rumor datasets. By utilizing a small subset of samples generated by various graph adversarial attack methods, we reconstruct the attack policy, closely approximating the performance of the original attack method. We validate that samples generated by the learned policy enhance model robustness through adversarial training and data augmentation.

Enhancing Robustness of Graph Neural Networks on Social Media with Explainable Inverse Reinforcement Learning
Yuefei Lyu', Chaozhuo Sihong Xie², Xi Zhang
Key Laboratory of Trustworthy Distributed Computing and Service (BUPT)
Ministry of Education, Beijing University of Posts and Telecommunications China Artificial Intelligence Thrust,
The Hong Kong University of Science and Technology (Guangzhou), China
Abstract
Adversarial attacks against graph neural networks (GNNs) through perturbations of the graph structure are increasingly common in social network tasks like rumor detection. Social media platforms capture diverse attack sequence samples through both machine and manual screening processes. Investigating effective ways lever- age these adversarial samples to enhance robustness is imperative. We improve the maximum entropy inverse reinforcement learning (IRL. method with the mixture- of-experts approach to address multi-source graph adversarial attacks. This method reconstructs the attack policy, integrating various attack models and providing feature-level explanations, subsequently generating additional adversarial samples fortify the robustness of detection models. We develop precise sample guidance and bidirectional update mechanism to reduce the deviation caused by impre- cise feature representation and negative sampling within the large action space of social graphs, while also accelerating policy learning. We take rumor detector as an example targeted GNN model on real-world rumor datasets. By utilizing a small subset of samples generated by various graph adversarial attack methods, we reconstruct the attack policy, closely approximating the performance of the original attack method. We validate that samples generated by the learned policy enhance model robustness through adversarial training and data augmentation.
Introduction
Social media platforms such as Weibo and Twitter host complex relationship networks that exhibit typical graph structure. Graph neural networks play crucial role in analyzing social graphs, demonstrating significant efficacy in a range of social network tasks, including rumor detection
2 4 5) spam detection
66 7
and stance detection [8] 9
Extensive research [T, has demonstrated that GNNs are vulnerable to adversarial attacks, allowing adversaries to manipulate downstream node classification outcomes by flipping small number of edges or features within the graph. For instance, in rumor detection, rumor spreaders may manipulate the graph structure to evade detection by reposting messages and following users. Recent research efforts have shifted towards acquiring such attack samples [T] [2], which can be obtained through manual supervision effective detection models. Analyzing these samples allows platforms to profile attackers, uncover their motives, and understand their attack patterns, thereby crucially enhancing the robustness of detectors defend against similar attacks.
"Corresponding authors: lichaozhuo@ bupt.edu.cn, zhangx bupt.cdu.cn.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

An x Rumor in the Social Graph
Attack Styles
Attack Sequences
Risk Effect
S 0000
Video shows "an entire block of unfinisihed houses collagood as a resutt an oar corthquake In Taiwwnn.
Pollwiigg
2
Medium
#Conerateree
2007 200roloueg
50 BK folowers
Post
Repost
Ac
50// derioon
User
Rumor
Figure I: An X(Twitter) rumor published on Politifact. Three instances of the rumor's propagation on X are listed, which imply different attack styles and sequences: (1) User A, who has notable number of followers. posted the rumor and gained considerable attention. The attack sequence involved purchasing followers and posting the rumor. (2) User B, with a large number of followers, retweeted the rumor originally posted by User A. This extends the last sequence to constitute sequence of purchasing followers, posting, and retweeting. (3) User C, with almost no followers, copied the content posted by User A and published it again, forming a one-step attack sequence. Repeated similar attacks can be seen as a sequence.
Utilizing adversarial training, which augments model generalization by introducing perturbed samples into training data, is a common and effective approach [T3] [4] [5] [6] [7]. The effectiveness of defense hinges crucially on the adversarial samples employed in adversarial training [1]] Current research on graph adversarial training primarily concentrates on devising effective attack methods to produce adversarial samples, thus fortifying the model's 's robustness against these attacks. However, within social networks, numerous attackers with diverse goals pose a challenge in developing attack methods that can simulate the wide array of real-world attacks, each characterized by different motives and styles, thus achieving comprehensive defense. Hence, we aim to reconstruct the attack policy to simulate multiple attackers as accurately as possible with the adversarial samples captured by social media platforms. It not only aids in gaining a more comprehensive understanding of the attackers but also facilitates the acquisition of additional samples for adversarial training.
natural idea is to use the captured attack samples as training data for supervised learning, known as Behavior Cloning (BC) [99,, which constitutes form of simple imitation learning. However, within social networks, attack samples frequently demonstrate interdependencies. as attackers commonly execute multiple steps of graph perturbation behaviors to accomplish their ultimate objectives. For example, [ proposed various camouflage behaviors aimed at deceiving rumor detectors. Rumor spreaders could combine several camouflage behaviors to evade from detection as shown in Figure [ In sequential decision-making scenarios, BC encounters the challenge of compounding error 20 as it leads to continual deviations from the observed sample distribution when faced with unknown states. Consequently, we can turn to inverse reinforcement learning (IRL) methods [22]. Diverging from reinforcement learning (RL) 23). IRL has access some expert demonstrations while lacking knowledge of the reward function. Although the agent can interact with the environment, it does not obtain rewards; instead, it deduces the reward function concerning sample features from expert demonstrations and subsequently leverages reinforcement learning to uncover the optimal actor. IRL simulates adversaria attack policies based observed data. Moreover, when employing linear reward functions and interpretable features, IRL offers feature-level post-hoc explanations (24), thus better aiding platform operators in understanding attack behaviors.
Reconstructing interpretable attack policies in social networks using inverse reinforcement learning poses two primary challenges. Firstly, expert demonstrations gathered from social media platforms originate from diverse attackers. Thus, it is imperative to develop a policy capable of simulating multiple experts as well achieving similar attack performance. Secondly, while linear reward functions and interpretable features provide transparent interpretations, their application to represent graph structure data within the large action space of social graphs poses significant challenges. Similar sample features may correspond to entirely disparate ground true rewards [2], which make difficulties in inverse reinforcement learning.
Therefore, we propose MoF-BiEnuRRI, an explainable bidirectional update maximum entropy inverse reinforcement learning method with the mindset of mixture-of-experts. It improves maximum entropy

---

inverse reinforcement learning (EndRL) [25] to estimate interpretable linear reward function and recover the attack policy. makes use of during the IRI. process and learns optimal policies by leveraging the strengths of each expert, and provides feature-level explanations. To address the issue of suboptimal linear feature representation of graph structure data, we introduce precise sample guidance and bidirectional update mechanism to speed up the exploration of reinforcement learning and reward function learning.
(MoE) model to cluster expert samples
Contributions. i) It studies a novel problem of reconstructing the attack policy with collected adversarial samples on social media. ii) Our approach enhances IRL techniques to handle the graph structured attack samples from diverse adversaries with large social graphs, while also offering inter- pretability. iii) On the real-world rumor datasets, we validate the policy reconstruction effectiveness of our method for multiple graph adversarial attack methods, and enhance the robustness of the GNNs rumor detector through data argumentation and adversarial training with additional samples generated by the reconstructed policies.
2 Background
Reinforcement learning. A Markov Decision Process (MDP) is defined as a tuple (S, A. P. 8). where S is set of states, A is a set of actions, P is the state transition probability function, r is the reward function, and ô is the discount factor. The core objective in RL is to learn a policy π : + A
that maximizes the expected sum of discounted rewards: (s) E,, IΣ== 8'r(S, A,) So s). where (s) is the value function under policy я. RL algorithms typically learn the action-value function Q+ a), which represents the expected return of taking action a in state and following policy æ thereafter. According to the Bellman Optimality Equation, the optimal action-value function defined (s, a) E [r(S,, A,) ō max,' Q" (S++1,,)) S. 8, A, a). The agent interacts with the environment to collect experiences, and then updates its policy or value functions to improve decision-making over time.
Inverse reinforcement learning. The core idea of IRL is to assume that the observed behavior is optimal with respect some unknown reward function. The task is then to recover this reward function such that the learned policy is (near-Joptimal under the recovered rewards. A classical formulation is Maximum Entropy IRL (EntIRL) 25 Given set of expert demonstrations DD it seeks to recover the reward function with the principle of maximum entropy along the trajectory {sp ag .... 3T Thus, the objective of EntRRL is defined as:
max Σ TED -P(T)logg() logp(T)
S.C. -I P(T) 1,
where p(T) is the probability distribution of the trajectory. for is the trajectory feature, and f is the expert feature expectation. EndRL assumes that p(T) eBalt)) where RT(T)= = = rs (s),,a)) ) is the cumulative reward with the reward function parameter 0. With the limitation of feature matching, the maximum likelihood method naturally aligns with the maximum entropy principle (26). Thus, the
loss function for EntRRL is the likelihood as: L(0)= = EveD log p(T((()) The locally optimal example like [27 28 is considered here. It segments the trajectory state-action pairs. Denoting the action
from state along the trajectory т, the previous assumption becomes p(als) e² (s,a) [25). With a discounting factor d = O, the action probability proportional to the exponential of the rewards encountered along
1 exp(ro(s, a)),
p(als) z where Z is the partition factor. The En loss function then becomes
(2)
I(0)) = Σ
aEA logp(als))
(3)
where A, is the action space under the state s. The linear reward function ro(s. a) 0T f(, a) is adopted here with feature extraction method f. Then, the reward function is employed to train the learner policy πT.
Mixture-of-experts. MoE is an ensemble model that consists of a gating network a and K expert networks (pi, Po..,..... PK} }. Each expert is used to learn and store knowledge from different fields, and
3

---

Attackers
R1
State 5
Action G,/G;
State (G,, Gj)
Action (Pim kn)
Attack
44
M5
sec SER
Node Phir
Alesaages
Attack Trajectories
Sel of Subarptie (30)
SG Poit
Add Edga
An Example of Attack Trajectory
Reconstruction (MoE: BIEMIRL)
Feature Extraction
Expert Samples
Reinforcement Learning
Precise Sample
Gate
as).0)
a)
Guidance
Action a
State
Reward
Pe, Pe; Poş
Reward Function
Bidirectional Update
f (s,
EntRL
Updule
MoF: Palicy
a (s)0 a(s,a)
Policy n (als)
EM
Defense
Dara Augmentation
Gate di:
Feature Weight 62
Targeted Model
Tw+1
Explanation
Adversarial Training
Simulation Trajectories
Figure 2: The framework of proposal. There are three stages: attack, reconstruction and defense. An example of attack trajectory in social networks is shown at the top right.
the gating network determines the expert network used for the inference based on the input. For each input, the gating network dynamically selects expert networks for activation, which can be indicated as p(ylæ)) = E. or (()))((()x)
Graph adversarial attack on social networks. The social network graph is denoted as G=(V, E). The node set V consists of the nodes representing messages, users and comments. The edge set consists of pairs (t,, Uz), where Ut 2y E V. Each edge potential edge can be mapped to its relation type with the fucntion & : (V,, by)} + L. The relation type set includes user-message, user-user and message-comment. The communities in social network are represented by set of connected components [G1,.., G., G, which are termed the subgraph in the sequel.
We focus on node classification task utilizing GNN model, denoted as g. Each node in g is associated with corresponding node label y/ E Our setting transductive, where the test nodes are observed during training without their labels. Within social networks, attackers aim to deceive the trained classifier g through evasion attacks. We assume that the attackers can only observe limited number of nodes and manipulate subset of edges. The observable node set is denoted by V C V. Here the modifiable edge set is defined as E' {(v,, v2) 04 E V", E V', (((,, uy)) E C}. enabling the manipulation between observable nodes. Additionally, there is target set O C V. allowing attackers to conduct global or targeted attacks within the controllable range by specifying the target set. The attacker modifies the graph G into ğ. The objective of attackers is to maximize the cost function LA Ev.eo L(g(v,), y1) in G. where L(.,-) is the loss between two input values.
3 Method
3.1 Framework
As shown in Figure 2 there are three stages in our situation: attack, reconstruction, and defense. Initially, the attacker on social media perturbs the social network with a sequence of manipulations, constituting an MDP trajectory. Multiple attackers generate N trajectories, denoted as (TI, T2, TN
With the variety of attack styles and purposes, our proposal assumes distinct policies л E (To, ..... decide the action each step. To expedite learning in large social network graphs, it decomposes edge flipping into three steps: source subgraph
where each 7, = (s) (0) (1) .....,
TT (T)

---

selection, destination subgraph selection, and node pair selection. The final reward of the trajectory which remains unknown the targeted social media platform. Each state-action pair time could be seen as observed expert sample, with feature extraction method, f employed to represent these pairs. Given the features of samples, the MoE policy is introduced to enhance the EntRI. method, deducing the reward function with EM algorithm. Then, with the improvement of precise sample guidance and bidirectional update mechanism, the learner policy æ is optimized continuously, The policy n could generate more trajectories {TN+1, TN+ to simulate real attack samples. With data augmentation or adversarial training, it could enhance the robustness the targeted model. Furthermore, by analyzing the reward function, it provides feature-level explanations of the attack samples.
3.2 Mixture-of-experts maximum entropy inverse reinforcement learning
3.2.1 Mixture-of-experts policy
With N observed trajectories (TI, T2, T..... TNJ and Tj = (s) : , ....., a (0
we as-
sume that the trajectory is generated by the following model
p(r 0) (()(0))
p(alt) ((()) )p( (p(s(t11)ss (
(4)
=
and the policy is the nixture-of-experr model
p(a1))300,0) = Σ K
A= (x( p))(((())())) 0z),
(5)
where ag (s(t), (p) is the gate function parametered by i,, and Σ (s (p) with given t.
There are K experts with parameters 0 (0), 0k) and each component p(a(")s()) 0s) represents an expert. With Eq. (2) and re(s, a) 0 f() we formulate the k-th expert at time t:
exp(0) ((()))
1(a (0 0x) = EoEA... exp(0, f(s(t),a)
(6)
where As, is the action space under the state (()) of the expert sample, and the denominator could be estimated with sampling.
3.2.2 EM algorithm
Each state-action pair is an observed sample. The expert to produce the t-th state-action pair in the observed trajectory Ty is unknown. The latent variable "ijkt if the t-th state-action pair of the trajectory Ty is decided by the k-th expert, otherwise Tike = O. The complete data include observed trajectory Tj and unobserved Tike with 1,2, N. The likelihood function of complete data is
N
70r, II
P(Tj, T5.100 71,,0: ..., 7(KT)
j=1
T-1 II t=
N T-1 K
II
p(5
(0)
((
(1)
[n
0z) Bett
Then parameters are estimated by EM algorithm 29
E-Step: Given the observed data (8 aaj (2) and current parameters (10, it computes the Q function
as
((0, E log P(T, 200))a ,000, 000]
T-1 K
N
(8)
ΣΣΣ
Pike log an (x)) + Foke log log p(a 11/9 (l/6,..)))))))))))))))))))))(()_
(=0 k=1 j=1
where tyke = E[Tske] is the responsibility for the observed sample as (x(s)) (2) )p
(1 18 6(00 Σ DiEl anls) pp(a )
fgke
P(ajke
1/a/5) (t) (2)
,87 (00)
5

---

M-Step: The goal is updating with
0 = arg max Q(0, 0(1).
(10)
8
Then the gate function loss and the expert loss for the k-th expert are respectively
Liaat (vp) Σ
Tike log on (5) )
(11)
(=
T-1 N
Len(On) (0.)
Σ
Feke log p(a logglllg
16 ,0))
(0
(12)
1=0 j=1
The expert loss shares a conceptual basis with the EntRR loss as Eq. (3). thus the EM algorithm can be employed to solve the IRL problem. With Eq. (6). the gradient of the normalized expert loss is
T-1
N
Ve (0s) fu
Tikt
E (e))s)) aEA,,."
(13)
NT
1=1
where Asy. is the action space for state
of and fa is the feature expectations for the k-th expert:
T-1 N
F
(s) aaa").
(14)
NT jml
updates each Og with gradient ascent and action space sampling. With learned Oz. the reward can be estimated by
K Σx k= (
ro(s,a)=
(15)
3.3 Improvement mechanism
Precise sample guidance. In inverse reinforcement learning, the objective obtain an accurate reward function from expert demonstrations, enabling the learner policy to approximate the expert's behavior. Adversaries utilize specific feature extraction methods f'. obtain embeddings for each attack behavior. However, in the context of social media, the feature extraction method f employed by the attack model unknown. The surrogate feature extraction method f is employed simulate the input of the attack model, replacing f' with f. This imprecise feature representation implies sensitive mapping from features rewards, where minor discrepancies could lead to significantly
different attack rewards 12 30
According the reconstruction process along the black arrows in Figure 2 the learner policy n.. cannot directly observe the raw expert samples. The information delivering of expert samples involves feature extraction, reward function estimation and RL policy update. This process necessitates both computations and sampling. Deviations in feature representation can accumulate, resulting in reward function that inadequately guides policy learning. Consequently, we introduce expert structural perturbations directly during the policy learning process, allowing the learner policy to replicate expert sample actions rather than relying on the imprecise features. Specifically, the initial stage of policy learning, we enforce the learner policy to execute expert actions at a predetermined frequency and assign maximum reward values to the trajectory.
Bidirectional update mechanism. While the precise guidance mechanism speeds up exploration in reinforcement learning, it does facilitate reward function learning in inverse reinforcement learning. Reward function learning relies solely on the EM algorithm with expert demonstrations as input, indicated by Eq. [3). Both feature representation deviations and action space sampling also impact reward function learning. By executing expert demonstrations through precise guidance and assuming they yield maximum rewards, we can incorporate this information into the parameter updates of the reward function. Specifically, during the precise sample guidance phase, we perform inverse updates with the loss
Lin. (0.) (f) 0 f(,
(16)
where (8, a) is the expert sample selected for enforcement and f is the maximum historical reward value. This process provides feedback opposite to the output of the reward function, ensuring synchronized learning of the learner policy and the reward function. During normal reinforcement learning phases without precise sample guidance, we update 0g according Eq. (I3).

---

3,4
Threat model and defense on social networks
With precise sample guidance and bidi- rectional update mechanism, we im- prove the mixture-of-experts EntRRL to MoE-BiEntIRL as the threat model to reconstruct the attack policy, The over- all algorithm as shown in Algorithm and the time complexity analysis is shown in Appendix D There are some details of MoE-BiEntlin for the node classification task on social media.
Algorithm 1: MoE-BiEndRL
Input:
Expert demonstration
number expert
demonstration N, number experts K, length of trajectories T, number of episodes E,, feature extraction function f. gate function reward
function parameters 0 (01,..., 0x). learner policy wt, negalive sample set D', responsibility matrix E x x inverse update episode set A
Output: Leamer policy TL
for = 1, ..... do env rev_rts for 2....... do i E A then ,' peeeepeeeeampaeeeeeeee Sample_guidance(21
Hierarchical reinforcement learning. Inspired by [2]. the hierarchical RL is employed and improved here, which in- cludes three layers as illustrated in Fig- ure 2 the source subgraph, the desti- nation subgraph, and the node pair. In the source or destination subgraph layer. the state is the graph G and the action is a subgraph G, or Gj at time In the node pair layer, the state and the ac- tion are the subgraph pair (G,, G,) and node pair (Um Un), respectively. Each layer is governed by policy. The state- action pairs correspond to the selection of source subgraph G;, destination sub- graph G₁ or node pair (Um- v,)) We employ a linear action-valuc function to learn the policy with LinUCB algorithm ВT. and it could be replaced with other RL methods.
r max_ max_reward())
clse
8 env pov_step(s, TL):
abtain_rewardee f a), as Eq. 15
10
T1. = update_policy(s, a,,', s
11
= calculate_responte caleulate_reponssiiittyy. D,, Eq.
12
for k 1,2,.... K do
if E A then
15
0g = inverse_uut inverse_update(cs D,0s) as Eq. (6
16
clse
Og gradient gradient_ascent(/ ascent(yy D, 0c)
Eq.
18
gradient ascent(7) with the loss as Eq.
Interpretable features. For feature ex- traction method f. comprehensible fea- tures can be employed to represent attack actions within the graph, as suggested by [32), facilitating the derivation of an interpretable reward function. The graph and node features designed in 12] are utilized here, focusing specifically on targeting rumor detectors. The details are shown in Appendix
Sampling. In the process of IRL, two sampling procedures are involved, as indicated in Eq. (6) and Eq. (1)). These procedures necessitate the sampling of state-action pairs to represent the action space. Here similarity negative sampling is adopted under specified assumptions. This method selects state-action pairs (s, a) based on the following criteria: i) Samples with high similarity to expert samples are prioritized, under the condition that the cosine similarity cos(f(s, (s, (s', a')) < μt, where (s', a') DD represents an expert sample. ii) In cases where (s, represents the selection of subgraph, there must be target nodes in the source subgraph G; and controllable nodes in the destination subgraph Gy-
Defense with adversarial samples. With the trained learner policy parameterized by we can generate additional samples to attack the targeted model g parameterized by Denoting the ground truth for node as yi, the predictions on clean and perturbed graphs are represented by yf and y. respectively. Robustness of the targeted model can be improved through offline data augmentation or online adversarial training. The overall loss is given by
LD = -D=ELo (ur. Σ (yir
(17)
In data augmentation, is updated while remains fixed. In adversarial training, the process can be viewed as minimax game: min, max Ip(aa,w) w). The attacker adjusts w maximize the loss while the defender alternately updates to minimize the loss.
7

---

4 Experiments
Dataset. Our focus is on the rumor detection task, for which we conduct experiments on two real-world datasets: Weibo [3 and Pheme (event ferguson in (34). These datasets contain both rumors and non-rumors, along with associated user, reposting, and comment data. Specifically, due the limited number of following relationships among users, we connect edges between user nodes as described in [12.. leveraging the potential user com- munities inferred from their posting messages. Dataset statistics are provided in Table T The datasets are split into training and testing sets using 7:3 ratio. We reconstruct the policy during
Table 1: Dataset statistics.
Weibo
Pheme
Nodes
10,280
2,708
Edges
16,412
4,401
Rumors
1,538
284
Non-rumors
1,849
859
Users
2,440
1,008
Comments
4,453
557
the training phase and implement the defense during the testing phase. In the training set, 20% of the authors and their posting messages are designated as controllable nodes, while all nodes in the testing set are considered controllable. All rumor nodes in the controllable set are regarded as target nodes, forming the set O. Attackers are only permitted to add edges between controllable users and messages.
Target model. The rumor detection model is a 2-layer GCN [5). The detection accuracy is shown in Table 3] The hidden layer dimension 64. Message node embedding represented using fixed text embedding layer during attacks. It is trained over 60 and 120 epochs for Weibo and Pheme, respectively, and employs the Adam optimizer with a learning rate of 0.0001.
Metric. Attack performance is measured using
ALA = (A LA()).
(18)
Here, the attack loss LA = E (g(r:) y1) represents the total loss between the rumor probability
and the ground truth for the target nodes in O. (0) and (T)) denote the attack loss in the clean graph and after 7sstep attacks, respectively. T serves as the horizon for RL and defines the budget for graph adversarial attacks. Specifically, it limits the modification of edges when attacking.
Attack method. The expert samples are collected through four graph adversarial attack methods, categorized based on their attack cost. Rule-based PageRank and black-box GC-RWCS are considered low-cost attacks. High-cost attacks include PR-BCD with a white-box setting and AdRumor-RL. with complete feature knowledge.
PageRank. This method establishes connections between users and messages with high influence, measured using the PageRank algorithm. Inspired by 1 and [12], it selectively links rumors with normal users or non-rumors with malicious users.
GC-RWCS [T]. Utilizing a black-box node selection strategy, this method employs a greedy procedure to determine node importance scores. Here it connects messages with high importance scores to influential users, utilizing the same influence measure and limited edge types as PugeRank.
PR-BCD 36). This is sparsity- aware first-order optimization graph adversarial attack method targeting GNNs in a woite-box setting. It proposes the surrogate loss for global attacks.
AdRumor-RI. RL 12]. This hierarchical contextual bandit attack framework targets GCN-based rumor detectors using interpretable features. It is an RL-based method to produce the serialized attack trajectories with black-box setting.
Attack performance evaluation of policy reconstruction. We reconstruct policies using expert samples generated by the aforementioned attack methods via MoF-BiEntRRI. The IRI. process consists of 1000 episodes. The precise sample guidance and bidirectional update mechanism is applied every two episodes during the first 500 episodes. For each attack method, select the top one to three attack trajectories based on performance as expert samples. The number of experts, K, is estimated using DBSCAN and is typically adjusted to range from I to 25, often being less than 10. The gate function is pre-trained with the labels generated by Gaussian Mixture Model (GMM) clustering. To prevent cluster collapse, adopt the weighted sum of one-hot labels and gate function outputs as the MoE gate. Each expert sample is augmented with 100 negative samples with sampling upper bound μ 0.8. All experiments are conducted using GTX 2080Ti (11GB) GPUs.
We compare MoF-BiEntIRI with two classical IRI. methods: (i) Apprenticeship Learning 37 which is based on maximum margin and faces an ill ill-posed problem introducing ambiguity. (ii EmtRR
8

---

Table 2: The attack performance of policy reconstruction evaluated using the average value of the last 100 episodes the metric AL A as shown Eq. (18). higher ALA means better performance. The rows and columns correspond to the IRL methods and attack models used to generate expert samples, respectively. The row Expert is the average performance of the expert samples. In the column of Mixture, we display the performance of the policy reconstructed with expert samples from all low or high cost attack methods.
High-Cost Attack
Low-Cost Attack
PRBCD AdRumor
Mixture
PageRank
GC-RWCS
Mixture
Expert
4.865
4.877
3,000
3.000
Weibo T=5
Apprenticeship
1.275
0.788
0.704
0.850
0.763
1.071
EntRL
4.650
4.770
4.550
5,000
4.950
4,950
MoE-BiEnIRIL
4.989
4.990
4,929
4.860
4,900
4,900
Expert
19.521
19.854
5.449
5.160
Weibo T=20
Apprenticeship
1.142
3,066
3.945
0,030
0.040
0,020
EmIRI.
19.030
19.749
19.199
19.830
20.000
20,000
MoE-BiEntRRI
19.876
19.936
19.979
19.970
19.700
18.749
Expert
4.804
5,947
2.991
3,990
Pheme T=S
Apprenticeship
1.788
3,387
2.619
0.000
0.000
0.000
EniRRL
0.000
0,018
0.010
0.000
0.062
0.000
MoE-Bii B--BBinnIRR.
2.205
4.965
4.277
1.488
2.105
1.549
Weibo, T-5
Weibo, T=10
Weibo, T=20
Pheme, T=5
AL
Mtof #iFirittt Helo BL. Update m/o PSB
Maf &i ErnirL wro Update wro PSB
McE BIEnURL Wib Di. Uprinte
5.0
3.5
McE BIENURL wil Bi Update
Wil P.B
Wil P6B
Episode
Episode
Episode
Episode
Figure 3: The smoothed curves of the ablation experiments for precise sample guidance and bidi- rectional update mechanism when recovering the policy of AdRumor-RL. The terms w/o Bi. Update and w/o P&B denote the removal of the bidirectional update mechanism and the removal of both improvement modules, respectively.
25 which applies the maximum entropy theory to IRL to alleviate ambiguity. The performance is shown in Table 2 Our findings indicate that: i) MoE-BiEntRLL outperforms the expert policy on Weibo. ii) Our method excels in reconstructing policies for high-cost attacks, while for simple low-cost attacks, EniRRI often outperforms due to Occam's 's Razor; however, our method also achieves comparable results. iii) Despite suboptimal effects on Pheme compared to experts, other IRL methods struggle to learn the policy, showcasing the difficulty of policy recovery. Furthermore, we validate the effectiveness of the precise sample guidance and bidirectional update mechanism, as depicted in Figure 3. particularly advantageous in challenging policy reconstruction scenarios.
The improvement of robustness with generated samples. We assess the efficacy of samples produced by MooE-BiEnIRL in enhancing robustness by subjecting the target model to attacks from PageRank, GC-RWCS, and PR-BCD. Evaluation is conducted under various conditions:
defense, data augmentation with expert samples (EDA), data augmentation with generated samples (DA), and adversarial training (AT). The trade-off parameter 3 in Eq. (17) is set to 8. Results are presented in Table
3 Simply using all expert samples for data augmentation does not yield effective defensive results. In contrast, employing additional samples generated by MoE-BiEntRRL exhibit the highest or second-highest improvement in robustness while maintaining accuracy in the clean graph.
Case study for interpretability. Our analysis focuses the expert samples generated by AdRumor- RL, which relies on a linear action-value function, with the policy parameter providing insight into feature importance. In our approach, determine the feature importance of the sample (s, a) through the calculation Σ o au (s). Table Dilllssrrtts the top eight important features elucidated

---

Table 3: The test accuracy decline (%) of the GCN rumor detector with T on Weibo dataset. The first row displays the attack method. The first column is the way to enhance the robustmess with adversarial samples. The second column is the method to generate the samples. The column under w/o Att. reflects test accuracy without attacks, while results under other columns reflect accuracy decline. The second row (w/o Def.) shows the accuracy (decline) without any defense method. Boldfaced font and mean the best performance and the runner-up among all methods respectively.
Table 4: The top-8 important features for subgraph selection with 5 on Weibo dataset, reflected by AdRumor- RL expert samples and the learned re- ward function, respectively. The over- lapping features are marked with the gray background. The features are de- scribed in Appendix
Expert sample
Reward function
The Source Subgraph
Att.
PageRank
GC-RWCS
PR-BCD
max potential
rumor review
w/o Def.
70.4031
-0.4042
40.4406
-0.1966
rumor review
n nodes n edges
PageRank
70.5998
-0.1821
-0.2440
0.0000
avg degree nodes author ratio n edges
GC-RWCS
70.7965
-0,4043
-0,4407
-0.1967
max degree
PR-BCD
70.3048
-0.2185
-0,2440
0.0000
max potential message ratio
AdRumor-Rl RL
70.7965
=-0.2076
-0,2440
0.0000
All above
70.7965
-0.2805
-0.3424
-0.0984
avg potential
max rumor inf
author inf min
review ratio
PageRank
70.6981
-0.5025
-0,5390
-0.2950
GC-RWCS
70.5015
-0.3059
-0,2440
0.0000
The Destination Subgraph
PR-BCD
70.4031
-0.1092
-0.1456
0.0984
avg potential
user inf min avg user inf avg author inf min author inf max user inf max author inf max nonrumor inf avg nonrumor inf
AdRamor-RL
70.6981
-0.3059
-0,3423
-0.0983
rumor ratio
MoE-BiEmiRL
70.6981
-0.1092
-0.1556
0.0984
min user inf author inf avg user inf
PageRank
71.0914
-0,2075
-0,2440
0.0000
GC-RWCS
70.2065
-0.4042
-0,4407
-0.1967
PR-BCD
70.4031
-0.3059
-0,3423
-0,0983
avg author inf
AdRamor-RL
70.6981
-0,3059
-0,3423
-0.0983
max author inf 0.0000
*-0.2731
+-0.2589
max user inf
by both AdRumor-RL and our method. The reward function enables the capture of the majority of important features.
Related Work
Graph adversarial attack and defense. Graph adversarial attacks include poisoning
38 and
evasion attacks (39), well global [40] and targeted attacks [IO), spanning both white-box and
black-box approaches [10] [1]. Adversarial samples are utilized in numerous studies to train robust
GNNs through adversarial training techniques [18 I3 [4]. As for rumor detection, some studies
explore graph adversarial attacks on social networks, as evidenced by
12
Inverse reinforcement learning. It includes maximum margin-based approaches like apprenticeship learning (37 and probability model-based methods such as EntRL (25) and REIRL [45]. Regarding explainable IRL, [46] explores potential clustering factors in demonstrations, offering expert-level explanations. 244 quantifies the importance of different goals in ICU hypotension management with linear reward function. Additionally, [47) also explores the combination of MoE and EntRR based
on decision trees.
Conclusion
We propose MoE- MoE-BiEntlRL, threat model to recover the graph adversarial attack policy against GNN model on social media. It utilizes the multi-source graph structured attack trajectories to learn generalized policy based on IRL techniques and MoE mindset, and provides feature-level explanations. The precise sample guidance and bidirectional update mechanism are designed to deal with the deviation caused by feature representation and negative sampling. Leveraging samples produced by the reconstructed policy, it could enhance the robustness of the target model. The broader impact and the limitation of our work are shown in Appendix A and respectively.
10

---

Acknowledgement
Yuefei Lyu, Chaozhuo Li and Xi Zhang were supported by the Natural Science Foundation of China (No. 62372057). Sihong Xie was supported in part by the National Key R&D Program of China (Grant No. 2023 YFFO72500)), the CHungghou-HHKUSTGZZ) Joint Funding Program (Grant No. 2023A0330008), and Education Bureau of Guangzhou Municipality. This material is based upon work supported by the National Science Foundation under Grant Number 2008155 & 1931042.
References
[1] Xiaoyu Yang. Yuefei Lyu, Tian Tian, Yifei Liu, Yudong Liu, and Xi Zhang, Rumor detection on social media with graph structured adversarial learning. In Proceedings of the twenty-ninth international conference international joint conferences artificial intelligence, pages 1417-1423, 2021.
[2] Tian Bian, Xi Xiao, Tingyang Xu, Peilin Zhao, Wenbing Huang. Yu Rong, and Junzhou Huang. Rumor detection on social media with bi-directional graph convolutional networks. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 549-556, 2020.
[3] Van Kin-Hoang Nguyen, Kazunari Sugiyama, Preslav Nakov, and Min-Yen Yen Kan. Fang: Leveraging social context for fake news detection using graph representation. In Proceedings of the 29th ACM international conference on information & knowledge management, pages 1165-1174, 2020.
[4] Tiening Sun, Zhong Qian, Sujun Dong, Peifeng Li, and Qiaoming Zhu. Rumor detection on social media with graph adversarial contrastive learning. In Frédérique Laforest, Raphaël Troncy, Elena Simperl, Deepak Agarwal, Aristides Gionis, Ivan Herman, and Lionel Médini, editors, WWW 22: The ACM Web Conference 2022, Virtual Event, Lyon, France, April 25 29, 2022, pages 2789-2797. ACM, 2022.
[5] Yi-Ju Lu and Cheng-Te Te Li. Gean: Graph-aware co-attention networks for explainable fake news detection social media. arXiv preprint arXiv:2004. 1164, 2020.
[6] Binghui Wang, Neil Zhenqiang Gong, and Hao Fu. Gang: Detecting fraudulent users in online social networks via guill-b--association on directed graphs. 2017 IEEE International Conference Data Mining (ICDM), pages 465-474. IEEE, 2017.
[7] Ao Li, Zhou Qin, Runshi Liu, Yiqun Yang, and Dong Li. Spam review detection with graph con- volutional networks. In Proceedings of the 28th ACM International conference on information and knowledge management, pages 2703-2711, 2019.
[8] John Pougué- Pougué-Biyong, Biyong, Akshay Gupta, Aria Haghighi, and Ahmed El-Kishky. Learning stance embeddings from signed social graphs. In Tat-Seng Chua, Hady W. Lauw, Luo Si, Evimaria Terzi. and Panayiotis Tsaparas, editors, Proceedings of the Sixteenth ACM International Confer- ence on Web Search and Data Mining, WSDM 2023, Singapore, 27 February 2023 March 2023, pages 177-185. ACM, 2023.
[9] Chen Li, Hao Peng, Jianxin Li, Lichao Sun, Lingjuan Lyu, Lihong Wang, Philip S. Yu, and Lifang He. Joint stance and rumor detection in hierarchical heterogeneous graph. IEEE Trans. Neural Networks Learn. Syst., 33(6)
2022.
[10] Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. Adversarial attack on graph structured data. In International conference machine learning, pages 111--1122 1124.124. PMLR, 2018
[11] Jiaqi Ma, Shuangrui Ding, and Qiaozhu Mei. Towards more practical adversarial attacks on graph neural networks. Advances in neural information processing systems, 33:4756-4766. 2020.
[12] Yuefei Lyu, Xiaoyu Yang, Jiaxin Liu, Sihong Xie, Philip S. Yu, and Xi Zhang Interpretable and effective reinforcement learning for attacking against graph-based rumor detection. In International Joint Conference on Neural Networks, IJCNN 2023, Gold Coast, Australia, June 18-23, 2023, pages 1-9. IEEE, 2023.

---

[13] Kaidi Xu, Hongge Chen, Sijia Liu, Pin- Yu Chen, Tsui- Wei Weng, Mingyi Hong, and Xue Lin. Topology attack and defense for graph neural networks: An optimization perspective. arXiv preprini arXiv: arXiv: 042 14, 2019.
[14] Fuli Feng, Xiangnan He, Jie Tang, and Tat-Seng Chua. Graph adversarial training: Dynamically regularizing based on graph structure. IEEE Transactions on Knowledge and Data Engineering, 33(6):2493-250) 2504, 2019.
[15] Zhijie Deng, Yinpeng Dong, and Jun Zhu. Batch virtual adversarial training for graph convolu- tional networks. Al Open, 4:73-79, 2023.
[16] Kaidi Xu, Sijia Liu, Pin-Yu Yu Chen, Mengshu Sun, Caiwen Ding, Bhavya Kailkhura, and Xue Lin. Towards an efficient and general framework of robust training for graph neural networks. In 2020 IEEE International Conference on Acousties, Speech and Signal Processing, ICASSP 2020, Barcelona, Spain, May 4-8, 2020, pages 8479-84489 8483. IEEE, 2020.
[17] Jintang Li, Jiaying Peng, Liang Chen, Zibin Zheng, Tingting Liang, and Qing Ling. Spectral adversarial training for robust graph neural network. IEEE Trans. Knowl. Data Eng., 35(9):9240- 9253, 2023.
[18] Lukas Gosch, Simon Geisler, Daniel Sturm, Bertrand Charpentier, Daniel Zügner, and Stephan Günnemann. Adversarial training for graph neural networks: Pitfalls, solutions, and new directions. Advances in Neural Information Processing Systems, 36, 2024.
[19] Dean A Pomerleau. Alvinn: An autonomous land vehicle in a neural network. Advances in neural information processing systems, 1, 1988.
[20] Stéphane Ross, Geoffrey Gordon, and Drew Bagnell. A reduction of imitation learning and structured prediction to no-regret online learning. In Proceedings of the fourteenth interna- tional conference on artificial intelligence and statistics, pages 627-633 JMLR Workshop and Conference Proceedings, 2011.
[21] Stephen Tu, Alexander Robey, Tingnan Zhang, and Nikolai Matni. On the sample complexity of stability constrained imitation learning. In Learning for Dynamics and Control Conference, pages 180-191. PMLR, 2022.
[22] Andrew Y Ng. Stuart Russell, et al. Algorithms for inverse reinforcement learning. In Icml, volume 1, page 2, 2000.
[23] Richard Sutton and Andrew G Barto. Reinforcement learning: An introduction. MIT press, 2018.
[24] Srivatsan Srinivasan and Finale Doshi Velez. Interpretable batch irl to extract clinician goals in icu hypotension management. AMIA Summits on Translational Science Proceedings, 2020:636, 2020.
[25] Brian D Ziebart, Andrew L Maas, J Andrew Bagnell, Anind K Dey, et al. Maximum entropy inverse reinforcement learning. Aaai, volume 8, pages 1433-1438. Chicago, IL, USA, 2008.
[26] E. T. Jaynes. Information theory and statistical mechanics. Phys. Rev., 106:620-630, May 1957.
[27] Sergey Levine and Vladlen Koltun. Continuous inverse optimal control with locally optimal examples. In Proceedings of the 29th International Conference on Machine Learning, ICML 2012, Edinburgh. Scotland, UK, June 26 - July 1, 2012. icml.cc / Omnipress, 2012.
[28] Nathan D. Ratliff, Brian D. Ziebart, Kevin M. Peterson, J. Andrew Bagnell, Martial Hebert, Anind K. Dey, and Siddhartha Srinivasa. Inverse optimal heuristic control for imitation learn- ing. In David A. Van Dyk and Max Welling, editors, Proceedings of the Twelfth International Conference on Artificial Intelligence and Statistics, AISTATS 2009, Clearwater Beach, Florida, USA, April 16-18, 2009, volume 5 of JMLR P Proceedings, pages 424-431. JMLR.org, 2009.
[29] Todd K Moon. The expectation-maxiiiina algorithm. IEEE Signal processing magazine, 13(6),47-00, 1996.
12

---

[30] Sili Huang, Yanchao Sun, Jifeng Hu, Siyuan Guo, Hechang Chen, Yi Chang, Lichao Sun, and Bo Yang. Learning generalizable agents via saliency-guidess features decorrelation. In Alice Oh, Tristan Naumann, Amir Globerson, Kate Saenko, Moritz Hardt, and Sergey Levine, editors, Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurlPS 2023, New Orleans, LA, USA, December 10- 16, 2023, 2023.
[31] Lihong Li, Wei Chu, John Langford, and Robert E. Schapire. A contextual bandit approach to personalized news article recommendation. In WWW, pages 661-670, 2010.
[32] Junhao Zhu, Yalu Shan, Jinhuan Wang, Shanqing Yu, Guanrong Chen, and Qi Xuan. Deepinsight: Interpretability assisting detection of adversarial samples on graphs. CoRR, abs/2106.09501, 2021.
[33] Changhe Song, Cheng Yang, Huimin Chen, Cunchao Tu, Zhiyuan Liu, and Maosong Sun. Ced: Credible early detection of social media rumors. TKDE, 3335533035-3047, 2021.
[34] Arkaitz Zubiaga, Maria Liakata, and Rob Procter. Learning reporting dynamics during breaking news for rumour detection in social media. CoRR, abs/1610.07333,, 2016.
[35]
Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In ICLR, 2017.
[36] Simon Geisler, Tobias Schmidt, Hakan Sirin, Daniel Zügner, Aleksandar Bojchevski, and Stephan Günnemann. Robustness of graph neural networks at scale. In Marc' Aurelio Ranzato, Alina Beygelzimer, Yann N. Dauphin, Percy Liang, and Jennifer Wortman Vaughan, editors, Advances in Neural Information Processing Systems 34: Anmual Conference on Neural Informa- tion Processing Systems 2021, NeurlPS 2021, December 6-14, 2021, virtual, pages 7637-7649, 2021.
[37] Pieter Abbeel and Andrew Ng. Apprenticeship learning via inverse reinforcement learning. In Carla E. Brodley, editor, Machine Learning, Proceedings the Twenty-firs International Con- ference (ICML 2004), Banff, Alberta, Canada, July 4-8, 2004, volume 69 of ACM International Conference Proceeding Series. ACM, 2004.
(38] Aleksandar Bojchevski and Stephan Günnemann. Adversarial attacks node embeddings via graph poisoning. In ICML, volume 97 of Proceedings of Machine Learning Research, pages 695-704, 2019.
[39] Huijun Wu. Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu. Ad- versarial examples for graph data: Deep insights into attack and defense. In IJCAI, pages 4816-4823, 7 2019.
[40] Daniel Zügner and Stephan Günnemann. Adversarial attacks graph neural networks via meta learning. In ICLR, 2019.
[41] Hao Yan, Chaozhuo Li, Ruosong Long, Chao Yan, Jianan Zhao, Wenwen Zhuang, Jun Yin, Peiyan Zhang, Weihao Han, Hao Sun, et al. A comprehensive study on text-attributed graphs: Benchmarking and rethinking. Thirty-seventh Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2023.
[42] Chaozhuo Li, Senzhang Wang, Dejian Yang. Zhoujun Li, Yang Yang, Xiaoming Zhang, and Jianshe Zhou Ppne: property preserving network embedding. Database Systems for Advanced Applications: 22nd International Conference, DASFAA 2017, Suzhou, China, March 27-30, 2017, Proceedings, Part I 22, pages 163-179. Springer, 2017.
[43] Jianan Zhao, Meng Qu, Chaozhuo Li, Hao Yan, Qian Liu, Rui Li, Xing Xie, and Jian Tang. Learning on large-scale text-attributed graphs via variational inference. arXiv preprint arXiv:2210.1 147009 2022.
[44] Peiyan Zhang, Jiayan Guo, Chaozhuo Li, Yueqi Xie, Jae Boum Kim, Yan Zhang, Xing Xie, Haohan Wang, and Sunghun Kim. Efficiently leveraging multi-level user intent for session-based recommendation via atten-mixer network. In Proceedings of the Sixteenth ACM International Conference Web Search and Data Mining, pages 168-176, 2023.
13

---

[45] Abdeslam Boularias, Jens Kober, and Jan Peters. Relative entropy inverse reinforcement learning. In Geoffrey J. Gordon, David B. Dunson, and Miroslav Dudik, editors, Proceedings of the Fourteenth International Conference on Artificial Intelligence and Statistics, AISTATS 2011 I, Fort Lauderdale, USA, April 1-13, 201 1, volume of JMLR Proceedings, pages 182-189. JMLR.org, 2011.
[46] Yunzhu Li, Jiaming Song, and Stefano Ermon. Infogail: Interpretable imitation learning from visual demonstrations. In Isabelle Guyon, Ulrike von Luxburg. Samy Bengio, Hanna M. Wallach, Rob Fergus, S. V. N. Vishwanathan, and Roman Garnett, editors, Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9, 2017, Long Beach, CA, USA, pages 3812-3822, 2017.
[47] Marko Vasic, Andrija Petrovic, Kaiyuan Wang, Mladen Nikolic, Rishabh Singh, and Sarfraz Khurshid. Moët: Mixture of expert trees and its application to verifiable reinforcement learning. Neural Networks, 151:34-47, 2022.
[48] Siyuan Guo, Lixin Zou, Hechang Chen, Bohao Qu, Haotian Chi, Philip Yu, and Yi Chang. Sample efficient offline-to-online reinforcement learning. IEEE Trans. Knowl. Data Eng., 36(3):1299-1311)) 2024.
14

---

A
Broader impact
Our method, rooted social media analysis, harnesses platform data bolster model robustness against attacks. Attackers face substantial data capture expenses and may find our method unsuitable for their particular objectives. conclusion, we posit that the benefits our approach surpass its drawbacks concerning social impact.
B Limitation
IRL commonly suffers from suboptimal expert samples, leading to noise in policy learning. The diverse nature of attackers on social media results varied sample effects, and platforms may erroneously capture normal samples. In this work, we categorize expert samples based on attack cost to mitigate excessive variance their true reward within an IRL context. Nonetheless, real-world implementation of such grouping may encounter challenges in accuracy and feasibility. Future research will foeus on enhancing IRL. resilience to noise and developing effective pre-classification methods. In addition, it faces the distribution shift problem [S]] due to the different distribution among the adversaries training data, the negative sampling data and the RL action space.
C Interpretable features
The interpretable features are designed by 12]. Detailed descriptions are provided in Table and Table 6 Features not within the range [0.1] are normalized using Min-Max normalization. With regard to the features present in Table 4 as long as the features have the same suffix, they are considered to capture the same important feature.
Table 5: The subgraph level features. # refers to the numher of. b means the ratio of to b. can be replaced with avg/max/min here, which means averge/maximmmmmiiiimm
Name
Description
Name
Description
Structural features
nodes
nodes.
clustering coeff.
The global clustering coefficient.
n edges
edges.
* degree
The avg/max//min node degree.
Social features
message rat. rumor rat.
message nodes: nodes. rumor nodes message nodes.
author author rat.
author nodes: # nodes. bad author nodes author nodes.
retweeter rat. rumor retweet
retweeter nodes: # nodes. retweeter nodes who connect rumor nodes retweeter nodes.
review rat.
# comment nodes # nodes. comment nodes who connect rumor nodes comment nodes.
rumor review
Influence features
author inf * user inf
The avg/max/min influence of author/user nodes.
* rumor inf * nonrumor inf
The avg/max/min influence of (non-)rumor nodes.
Attack potential features
* potential
The avg/max/min prohability of target rumors.
attack degree
added edges in the previous steps horizon
Ranking help message features The avg/max/min prohahility of non-target rumors.
* rhm suspicious
D The time complexity
The time complexity of MoF-BiEntIRL. There are three principal phases of MoE-BiEntRR and indicate the corresponding lines of Algorithm Tas as follows.
15

---

Table 6: The node level features. # refers to the number of. means the ratio of to 6. can be replaced with avg/max/mmn here, which means avenge/naxiimm/nnnnnnn..
Name
Description
Name
Deseription
Structural features
degree
The degree of node.
ego n edges
edges the ego network.
Social features
good bad
0 if the node is good author non-rumor, if the node is bad author or rumor.
ego rumor
# rumor nodes # nodes in the ego network.
rat.
ego bu rat.
# bad author nodes : # nodes in the ego network.
node type
The one-hot vector to indicate the node type (rumor, non-rumor, good author, bad author).
ego review
# comment nodes nodes in the ego network.
Inftuence features
ego user inf ego message inf
The average influence of the user/ message nodes in the ego network.
node inf
The influence of the node.
Attack potential features
node potential
The avg/max/min probability of target rumors within -hhop insides, The avg/max/min probability of target rumors within the node 3-hop insides.
node attack degree
# added edges that connect to the node the previous steps horizon T.
neighbor suspicious
n targets distance
The average distance from the node to the target rumors within the node 3-hop insides.
targets
# target rumors within the node k- hop insides.
Ranking help message features
rhm suspicious
The avg/max/min probability of non- tonnttrget rumors within the node 3-hop insides.
Phase I- interaction (line 8): Our proposal conducts T Tsstep attacks and interacts with the environ- ment. Each attack step requires feature updates for the involved subgraphs and nodes, including forward pass on the target model. For the L-layer GCN as the target model, the time complexity of the forward pass is approximately O(L LN,d²). where N,, and No denote the numbers of nodes and edges in the input graph, respectively, and d is the feature dimension.
Phase II reward acquisition (line 12, 17 and 18): The reward estimated with the IRL module, ascent, and gate function updates. The time complexity for an episode ONN + K)), where N is the number of expert trajectories, T is the trajectory length, K is the number of experts, d is the feature dimension, and S is the number of negative samples.
including responsibility calculation, gradient ascent,
Phase III policy update (line 10): In our work, employ the LinUCB algorithm, characterized by a policy update time complexity of (dd)).
Overall, the total time complexity for an episode is approximately K) + d²). Here the precise sample guidance (line and 6) and bidirectional update mechanism (line 15) are not considered, which would reduce the time complexity in practice.
The time complexity analysis of baselines. The time complexities of our proposal and baselines summarized in Table The complexities of the interaction phase and policy update phase in the baseline models are identical to those in the proposed model, differing only in the reward acquisition phase. The time complexities of the reward acquisition phase within the baselines are
Apprenticeship Learning: O(Ndd):
EntRL: ONNdSS).
Summary. Based on Table 7 the time complexities of our proposal and the baseline methods primarily diverge during the reward acquisition phase of IRL. Our approach introduces K experts
16

---

Table 7: This table outlines the time complexity and runtime of the MoE-BiEntIRL model proposed herein, alongside two baseline models. Time complexity is delineated across three principal phases: (I) interaction, (II) reward acquisition, and (IIII) policy update. The reported total rumning time denotes the average duration of a single episode, Additionally, specific attention given to the runtime of reward acquisition phase for clarity and comprehensive evaluation. The runtime of experiments
Weiho and Pheme displayed with 7=5 and N=3.
Time complexity
Total / Phase Runtime
Phase 1
Phase
Phase III
Weibo
Pheme
Apprenticeship
O(TLN TLN.d
O(NTd)
O(d))
4.52 / /0.02
0.55 0.02
EmtRL
O(TLNd (LNNd))
O(NTAS)
Odd))
5.01 0.09
0.67 0.07
O
O(NTKa(S + K))
O(d))
5.31 /.33
0.81 0.24
to manage multi-source attack trajectories with diverse motivations, thereby increasing the time complexity. Notably, the complexity associated with reward acquisition is independent of the input graph size and hinges solely on the predefined hyperparameter K, typically ranging from to 10, rendering the increased complexity manageable. Moreover, the predominant computational effort across all models is concentrated in the interaction phase, which further mitigates the impact of introducing multiple experts. Table 7 details the runtimes of complete episodes and the phase II. Despite the extended runtime of the MoE-BiEntRLL approach in the reward acquisition phrase, it exerts negligible influence on the total runtime. Both the analysis of time complexity and experimental findings emphasize that the actual runtime is largely influenced by the interaction phase. Therefore, the additional complexity introduced by employing MoE within the reward acquisition phase remains manageable.
17

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The contributions and scope are stated in the abstract and introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitations in Appendix
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
18

---

Justification:
The assumption is stated in section 2 and the complete inference is shown in section 3.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We describe the details of the framework presented in this paper in Sections 3, and 4.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
19

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [No]
Justification:
According to the content of the paper, our work reproducible.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips... cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ "cipps.c/puullc//guu /itee//ggudddeeeedSuuuubmiibii ssionPolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We state the training and testing details in section 4.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: Error bars are not reported because it would be too computationally expensive.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
20

---

The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative emrr rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We state our sufficient information on the computer resources in Section 4.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
Our work conform with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is a special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer:
[Yes]
Justification:
We discuss that Appendix
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
21

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
We use the public datasets and tag the sources.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
22

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets,
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
23


Reviews:
[{"review_id": "vMmJnD8pdl", "reviewer": "Reviewer_E98Q", "summary": "The paper presents a novel method, MoE-BiEntIRL, which combines a mixture-of-experts approach with inverse reinforcement learning to enhance the robustness and explainability of adversarial attacks on GNNs. The method addresses the critical issue of stabilizing GNNs used in social media for rumor detection, demonstrating significant practical relevance. Strengths include its innovative approach, comprehensive mechanisms for improving attack policy accuracy, and robust evaluation results. However, the paper could benefit from clearer explanations of the method, detailed parameter sensitivity analysis, enhanced experimental reproducibility, expanded comparative baselines. Despite these minor weaknesses, the overall contribution and practical importance of the research are compelling.", "questions": "1. Could you provide a simple illustrative example or additional details to clarify how the precise sample guidance mechanism and the bidirectional update mechanism work in the MoE-BiEntIRL method?\n2. Can you provide a brief overview of the computational complexity of your proposed method, along with any potential optimizations that could be considered to enhance practical feasibility?", "limitations": "The authors have listed the limitations in appendix.", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "1. The MoE-BiEntIRL method presents a highly novel application of a mixture-of-experts approach combined with inverse reinforcement learning to address adversarial attacks on Graph Neural Networks (GNNs). This innovative approach stands out in its ability to not only enhance the robustness of GNNs but also to provide explainability to the attack policies.\n2. The inclusion of precise sample guidance mechanisms and a bidirectional update mechanism demonstrates thoroughness in approach, aiming to improve both the accuracy of attack policy reconstruction and the speed of policy learning. This comprehensive approach adds substantial value to the proposed solution.\n3. The evaluation methods employed in this study are robust, validating the effectiveness of the proposed method. The results are compelling, showing notable improvements in the robustness of GNNs.", "weaknesses": "1. Although the proposed method is innovative, some aspects of the algorithm could benefit from clearer explanations. \n2. A minor issue is that the sensitivity of the model to various parameters is not thoroughly explored. A brief analysis or guidance on parameter selection could aid in the practical application of the method.\n3. While the method is novel, there is little discussion on its computational complexity. Including an analysis of the computational cost and suggesting optimizations could enhance the practical feasibility of the approach.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Q1: Could you provide a simple illustrative example or additional details to clarify how the precise sample guidance mechanism and the bidirectional update mechanism work in the MoE-BiEntIRL method?**\n\n**A1:** Thank you for your suggestion. We have provided code and algorithms in global rebuttal Q2, which illustrate when and how the precise sample guidance mechanism and the bidirectional update mechanism operate.\n\nDuring the early stages of learning, precise sample guidance and inverse updates are performed periodically. In an inverse update episode, the steps for executing the RL policy are replaced with precise sample guidance steps, and attacks are carried out according to the given expert samples. As for the reward, it is assigned the maximum historical reward. Given the sample and reward, the gradient ascent update of the IRL is replaced with the inverse update after the responsibility calculation.\n\n**Q2: Can you provide a brief overview of the computational complexity of your proposed method, along with any potential optimizations that could be considered to enhance practical feasibility?**\n\n**A2:**  Thank you for your valuable suggestion. Please see Q1 in the global rebuttal for further details.\n\n**Q3: A minor issue is that the sensitivity of the model to various parameters is not thoroughly explored. A brief analysis or guidance on parameter selection could aid in the practical application of the method.**\n\n**A3:** Thank you for your suggestions. Here, we provide guidelines for selecting some parameters:\n\n- The sampling upper bound $μ$:  This parameter controls the similarity between the negative sample and the expert sample. Considering the validity of hard negative samples, we tend to choose samples with higher similarity, setting $μ=0.8$.\n- The learning rates of the learner policy, inverse update, and gate function: These are determined using grid search.\n\nWe have included a sensitivity analysis of parameters in Figure 2 in the PDF. Our findings are as follows:\n\n- Sampling similar instances can be advantageous for policy reconstruction; however, selecting instances that are too similar can lead to the failure of Inverse Reinforcement Learning (IRL).\n\n* The learning rates for both the learner policy and the inverse update process are more sensitive compared to that of the gate function.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "azp6illflz", "reviewer": "Reviewer_QAYk", "summary": "This work studies the problem of reconstructing attack policies using collected adversarial samples to enhance the robustness of GNN-based models in social network tasks, specifically rumor detection. The authors propose the MoE-BiEntIRL framework, which employs a mixture-of-experts approach to learn optimal policies from diverse adversaries, and provides feature-level explanations by estimating interpretable linear reward functions. Experiments on two real-world rumor detection datasets validate the effectiveness of MoE-BiEntIRL.", "questions": "Please refer to the weaknesses section.", "limitations": "The authors have adequately addressed the limitations.", "rating": 5, "confidence": 5, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The authors investigate the rumor detection problem from the novel perspective of reconstructing attack policies.\n\n2. The paper is well-written and well-organized, with motivating illustrations of the problem.", "weaknesses": "While the proposed problem and approach are generally novel and intriguing, the following issues regarding experiments require further clarification:\n\n1. **Table 2:** What makes the policies on Pheme significantly harder to recover than the policies on Weibo?\n\n2. **Table 3:** The results are not clearly illustrated and explained.\n    -  For instance, it appears that the column under \"w/o Att.\" reflects test accuracy (%), while results under other columns reflect accuracy decline in actual numbers. Please align the representations for consistency.\n    -  If \"w/o Att.\" refers to GCN's rumor detection performance without adversarial attacks, it is surprising to see that GCN only achieves ~70% test accuracy on the Weibo dataset with binary rumor / non-rumor labels. The authors claim that the Weibo dataset is adopted from existing work [1], which reported over 80% test accuracy on Weibo even using simple models such as TF-IDF or GRU. Please elaborate on the causes for this significant performance discrepancy, e.g, data differences and model structure differences.\n\n3. **Computational Efficiency:** Given the complexity of the model structure illustrated in Figure 2, it would be beneficial to benchmark the computational efficiency of the proposed approach against the baselines in Table 3.\n\n[1] Changhe Song, Cheng Yang, Huimin Chen, Cunchao Tu, Zhiyuan Liu, and Maosong Sun. Ced: Credible early detection of social media rumors. TKDE, 33(8):3035–3047, 2021.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Q1: What makes the policies on Pheme significantly harder to recover than the policies on Weibo in Table 2?**\n\n**A1:** Thank you for your insightful question. We posit that the difficulty in policy recovery is related to the complexity of the underlying graph structures. As indicated in Table II of the PDF, we have devised several metrics to assess the complexities of the Weibo and Pheme datasets [1-3]. The data reveals that the graph structure of Pheme is more complex than that of Weibo, characterized by a larger variance in node degree and a higher graph density.\n\nReturning to the proposed model, the success of Inverse Reinforcement Learning (IRL) in recovering expert policies is influenced by several factors, including the quality and quantity of expert demonstrations, the complexity of the expert policies, and the variability of the environment. In our humble view, the attack sequences within complex social graphs exhibit significant cascading effects [4], complicating the recovery of these policies. The more intricate the graph structure, the more substantial the cascading effect due to edge-flipping attacks. Such an attack can propagate from a target node to multiple others, thereby impacting the overall system performance because of the high interdependence and connectivity among nodes. Complex graphs increase the likelihood of cascading reactions triggered by attack behaviors.\n\nFurthermore, sequential attacks on these graphs intensify cascading reactions, potentially altering the characteristics of numerous nodes and causing environmental changes within the reinforcement learning process. Attackers may also optimize their strategies, adding more decision conditions and steps to navigate the complex social graph effectively. Together, these factors contribute to the increased difficulty of IRL in recovering expert policies.\n\nAs presented in Table II, all baseline methods, including Apprenticeship Learning and EntIRL, exhibit suboptimal performance in recovering policies due to the complexity of the social graph in Pheme. In contrast, our approach, which integrates a mixture of experts to accommodate the attack sequences generated by complex social graphs, consistently achieves state-of-the-art performance on these challenging datasets.\n\n[1] Complex networks: Structure and dynamics. 2006.\n\n[2] The structure and function of complex networks. 2003.\n\n[3] Graph measures and network robustness. 2013.\n\n[4] Cascading failures in complex networks. 2020.\n\n**Q2: The unclear description and significant GCN performance discrepancy with [1] in Table 3. (Weakness 2 in reviews)**\n\n**A2:** Thank you for your correction and constructive question.\n\n**(1)** We apologize for not clearly describing the columns in Table 3. As you mentioned, the column under \"w/o Att.\" reflects test accuracy (%), while results under other columns reflect accuracy decline in actual numbers.\n\n**(2)** The reasons for this discrepancy in attack effectiveness are multifaceted:\n\n- **a)** **Dataset Differences:** The *weibo-all* dataset referenced in [1] is sourced from the CED repository in Github, which includes the Rumdect dataset and the ChineseRumorDataset. However, the URL for Rumdect is no longer valid. Moreover, the *weibo-all* dataset in CED repository is pre-processed and lacks user IDs for message reposts, preventing the construction of the social following graph. Therefore, we utilized the original ChineseRumorDataset, which comprises 3,387 Weibo posts (1,538 rumors and 1,849 non-rumors), in contrast to the *weibo-all* dataset's 8,050 Weibo posts (3,581 rumors and 4,199 non-rumors).\n- **b)** **Preprocessing Differences**: In previous work [1], all reposting and comment information was either retained or filtered with the early rate (ER). Our approach focuses on retaining early repost messages and comments published within the first 25% of the average time interval and selectively retaining those with high information entropy. To achieve this, we removed stop words and punctuation, segmented the text, calculated the word information entropy for each text, and retained only those texts with entropy values higher than 90% of the highest observed entropy.\n- **c)**  **Model Differences**: We used pre-trained word2vec embeddings and an embedding layer to encode the text content, whereas [1] used TF-IDF + NN as the encoder. We also supplemented the experimental results using TF-IDF encoding as shown in  Table Ⅲ in the PDF. TF-IDF slightly outperforms word2vec embeddings. Pre-trained word2vec embeddings might suffer from poor representation of low-frequency words or differences between training corpora and the target task domain. Additionally, our proposal consistently outperforms the baselines with various text encoders, highlighting the effectiveness of the MoE framework.\n\n[1] Ced: Credible early detection of social media rumors. 2018.\n\n**Q3: Computational Efficiency: Given the complexity of the model structure illustrated in Figure 2, it would be beneficial to benchmark the computational efficiency of the proposed approach against the baselines in Table 3.**\n\n**A3:** Thank you for your valuable suggestion. Please see Q1 in the global rebuttal for further details.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2JyhNgu2vb", "reviewer": "Reviewer_M7DL", "summary": "This paper addresses the challenge of adversarial attacks on Graph Neural Networks (GNNs) employed in social media tasks, such as rumor detection. The authors introduce MoE-BiEntIRL, a method that leverages a mixture-of-experts approach combined with inverse reinforcement learning (IRL) to reconstruct and explain adversarial attack policies. The objective of this method is to enhance the robustness of GNNs by generating additional adversarial samples for training, thereby improving resilience against attacks. MoE-BiEnt\\IRL incorporates mechanisms for precise sample guidance and bidirectional updates, which are designed to optimize both the accuracy and the speed of policy learning.", "questions": "1.\tScalability Analysis Could you elaborate on how your method scales when applied to very large social media graphs? Any additional insights or preliminary results on this matter would be highly informative. \n2.\tCould you provide more detailed information regarding your experimental setup? Additional details would aid in understanding how to replicate your study effectively.", "limitations": "The paper's limitations are adequately addressed in the supplementary material. There are no further suggestions at this time.", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 4, "strengths": "1. Innovative Approach: The introduction of MoE-BiEntIRL represents a significant innovation, particularly through its application of a mixture-of-experts approach to manage diverse adversaries and provide detailed feature-level explanations. \n2. Real-world Validation: The method is validated on actual datasets from Weibo and Pheme, demonstrating its practical applicability for improving the robustness of GNNs in social media rumor detection scenarios. \n3. Experimental results, focusing on policy reconstruction and adversarial training, effectively illustrate the method’s robustness and efficacy.\n4. The approach facilitates a deeper understanding of attack behaviors through feature-level explanations, aiding platform operators in enhancing system defenses.", "weaknesses": "1. The proposed method involves multiple stages and sophisticated mechanisms, potentially complicating its implementation. \n2. Scalability Discussion: The paper would benefit from a more extensive discussion on the scalability of the method, particularly concerning its applicability to large social media graphs. \n3. Experimental Setup Details: Enhancing the description of the experimental setup would significantly improve the reproducibility of the study and aid other researchers in replicating the results.\n4. Typos and grammar errors could be avoided.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Q1: Scalability Analysis: Could you elaborate on how your method scales when applied to very large social media graphs? Any additional insights or preliminary results on this matter would be highly informative.**\n\n**A1:**  Thank you for your valuable suggestion. \n\nFor the scalability in the large social media graphs, we analyze the time complexity of our method. Please refer to Table I in the attached PDF, where we detail the time complexity and runtime of the MoE-BiEntIRL, alongside two baseline models. \n\nBased on Table I in the accompanying PDF, the time complexity of our proposal and the baseline methods primarily diverges during the reward acquisition phase of IRL. Our approach introduces $K$ experts to manage multi-source attack trajectories with diverse motivations, thereby increasing the time complexity. Notably, the complexity associated with IRL reward acquisition is independent of the input graph size and hinges solely on the predefined hyperparameter $K$, typically ranging from 1 to 10, rendering the increased complexity manageable. Moreover, the predominant computational effort across all models is concentrated in the attack stage, which further mitigates the impact of introducing multiple experts. Table I details the runtime of complete episodes and the IRL module. Despite the extended runtime of the MoE-BiEntIRL approach in the IRL module, it exerts negligible influence on the total runtime. Both the analysis of time complexity and experimental findings emphasize that the actual runtime is largely influenced by the attack stage. \n\nPlease see Q1 in the global rebuttal for further details about the time complexity analysis.\n\nBased on the aforementioned time complexity analysis, the scalability of the IRL module easily scalable as it exhibits no direct correlation with the size of the graph. When applied to larger graphs, parameters such as $T$, $K$, $N$, and $S$ may indirectly increase due to the diverse nature of attacks within these larger contexts. As illustrated in Table I, the runtime of the IRL module shows minimal variation across datasets of varying sizes (e.g., Weibo with 10,280 nodes and Pheme with 2,708 nodes). As discussed in time complexity analysis, the predominant factor influencing runtime is the attack stage. Thus, in our humble opinion, the scalability of the proposed model is acceptable. \n\nFurthermore, as for the hyperparameters affected by the large graph indirectly, various methods can mitigate the time complexity and the runtime of the Inverse Reinforcement Learning (IRL) module through careful control of hyperparameters:  (1) **$K$:** Reduce the number of experts by phased experimentation, employing a coarse-to-fine division of experts.   We design this method and conducts expriements, which details are shown in Q1 of the global rebuttal.   (2) **$T$:** Segment lengthy expert trajectories using predefined rules or models to minimize state correlation before and after each segmentation.   (3) **$N$:** Employ pre-classification or clustering of multiple expert samples to reduce the number of expert trajectories.\n\n**Q2: Could you provide more detailed information regarding your experimental setup? Additional details would aid in understanding how to replicate your study effectively.**\n\n**A2:**  Thank you for your valuable suggestion. Please see Q2 in the global rebuttal for further details.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "WqsetJBG99", "reviewer": "Reviewer_sELL", "summary": "The paper presents a novel approach to enhancing the robustness of Graph Neural Networks (GNNs) against adversarial attacks, specifically in social media contexts such as rumor detection. The authors propose an enhanced maximum entropy inverse reinforcement learning (IRL) method with a mixture-of-experts approach to tackle multi-source graph adversarial attacks. This method aims to reconstruct attack policies, integrate various attack models, and generate additional adversarial samples to improve the robustness of GNN-based detection models.", "questions": "Could this approach be transferred (with respective modifications) to bit flips, e.g., [1]?\n\nDid you analyze the impact of varying Rich-club coefficients in the datasets?\n\n[1] https://arxiv.org/abs/2311.01205", "limitations": "The method assumes that the perturbations captured during training are representative of real-world adversarial attacks.\n\nFurther testing on different graph types and applications is required to confirm the broader applicability of the proposed method.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "The application of inverse reinforcement learning to reconstruct adversarial attack policies is novel and offers a highly interesting perspective on enhancing GNN robustness.\n\nCombined with the Mixture-of-Experts, the method allows for the integration of various attack models, providing comprehensive feature-level explanations and robust adversarial samples for use in adversarial training.\n\nThe generation of good additional adversarial samples for training improves the GNN’s resilience to attacks, which is a significant step towards robust social media analysis. \n\nThe authors use real-world social media datasets to validate the proposed method.", "weaknesses": "The proposed method involves multiple components (IRL, mixture-of-experts, bidirectional updates), which can increase the computational complexity and may not be easily scalable.\n\nThe focus is primarily on rumor detection in social media, which, while important, might limit the generalizability of the method to other types of graphs and applications.\n\nSome sections, particularly those involving the theoretical underpinnings of IRL and mixture-of-experts, could be more clearly explained to enhance understanding and accessibility.\n\nNo code is provided. This hinders the exact reproduction of results.\n\nI think the authors use the term \"Threat model\" in an incorrect or at least unorthodox way that will likely be misunderstood in the security community and potentially beyond. Specifically, in line 229, the authors start a paragraph called “Threat model” and they proceed to describe that they use, GCN, number of hidden dimensions, optimizer, etc. This is not what is typically understood as a threat model in literature: a model of a threat actor's capabilities, possible courses of action they may take and how it will impact the operation of a computer system [1]. Speaking of it, including an actual threat model (or rather making the implicitly exiting model explicit) would certainly strengthen the paper and increase acceptance in the security community.\n\nMinor issues:\nTypos/grammar in lines 13, 69, 109, 111\n\n[1] https://www.sciencedirect.com/science/article/abs/pii/S0167404818307478", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Q1: Could this approach be transferred to bit flips?**\n\n**A1:** Thank you for your constructive question. We believe that it is feasible theoretically.\n\n**(1)** Bit flip attack: This attack disrupts neural network operations by flipping bits in parameters or intermediate results. For example, [1] degrades GNN performance by selectively flipping bits in quantized weights and biases, targeting those most impactful to the model's injectivity.\n\n**(2)** To transfer our work to bit flips, the key is to model bit flip attacks as a MDP for RL. Suppose there are $T$ -times bit flips to achieve an effective attack, defining the attack trajectory with $T$ steps. The RL elements are:\n\n- State: The current GNN parameters;\n- Action: Flipping the specific bit in the parameters, which could be represented by a mask matrix;\n- Reward: Estimated by the IRL module;\n- Policy: Given the current state, output the next action. A deep RL policy, such as Actor-Critic (AC), might be effective for handling the state from the deep models.\n\nFor IRL, it is suggested to use a neural network as the reward function because it is difficult to design interpretable linear features for bit flip attacks when targeting the internals of an end-to-end deep model. Given the target GNN model and some expert bit flip attack trajectories, the learner policy produces the attack actions and updates with the reward from the IRL module to approximate the expert policy.\n\n[1] Attacking Graph Neural Networks with Bit Flips: Weisfeiler and Lehman Go Indifferent\n\n**Q2: Did you analyze the impact of varying Rich-club coefficients in the datasets?**\n\n**A2:** Thank you for your vaulable suggestion. The rich-club coefficients of Weibo and Pheme are shown in Figure 1 in the PDF. The analysis reveals that:\n\n**(1)** As the degree increases, the rich-club coefficient first rises and then falls, indicating that nodes with moderate influence in the social network have higher connectivity with each other.\n\n**(2)** Pheme exhibits higher rich-club coefficients compared to Weibo, suggesting that the social network on Pheme is more densely connected overall. As a result, attacks on Pheme generate more pronounced cascading effects [1], thereby complicating the recovery of attack policies, which aligns with the experimental results presented in Table 2. The model's performance on Pheme, which has a higher rich-club coefficient, is lower compared to the performance on Weibo with smaller rich-club coefficients. \n\n[1] Cascading failures in complex networks\n\n**Q3: The proposed method involves multiple components, which can increase the computational complexity and may not be easily scalable.**\n\n**A3:** Thank you for your valuable suggestion. Please see Q1 in the global rebuttal for further details. \n\n**Q4: It might limit the generalizability of the method to other types of graphs and applications.**\n\n**A4:** Thank you for your suggestion. To verify the generalizability, we have adapted and implemented our method for the recommendation system task.\n\n- Dataset: Gowalla [1], includes 13,591 users, 14,322 items, and 227,193 interactions.\n- Interpretable Features: The domain-specific features used for rumor detection in our work were modified to suit recommendation systems.\n- Metric: ΔNDCG, which measures the reduction in NDCG@20 value after $T$-step attacks.\n- Target Model: PinSage [2]. Without attacks, the NDCG value on the training set is 0.4139.\n- Attack Method: We improved AdRumor-RL with the features in (2) and generated three expert trajectories, each with 5 steps. It conducts the global attack and updates with the reward ΔNDCG. The average attack performance (ΔNDCG) is 0.0325.\n- Performance: Results of policy recovery are as follows. The learner policy achieved 90% of the performance of experts. Our method is effective in the recommendation system task.\n\n|       | Expert | Apprenticeship | EntIRL | MoE-BiEntIRL |\n| ----- | ------ | -------------- | ------ | ------------ |\n| ΔNDCG | 0.0325 | 0.0067         | 0.0268 | 0.0294       |\n\n[1] Friendship and mobility: User movement in location-based social networks\n\n[2] Graph convolutional neural networks for web-scale recommender systems\n\n**Q5: The theoretical underpinnings of IRL and MoE could be more clearly explained.**\n\n**A5:** Thank you for your suggestion. We provide explanations for EntIRL and MoE as follows.\n\n**(1) EntIRL** infers the reward function in the environment by maximizing the entropy of the path distribution. Thus, the EntIRL objective is defined as $\\max\\sum -P(τ) \\log P(τ)$ with trajactory $τ$. It assumes that $P(τ|θ)∝\\exp(R_θ(τ))$, where $R_θ(τ)$ is the reward function with parameter $θ$. The loss function for EntIRL is the likelihood $L(θ) = \\sum \\log P(τ|θ)$ because maximizing likelihood and maximizing entropy share the same goal [1].\n\nIn our work, we consider locally optimal examples, segmenting the trajectory as state-action pairs. The previous assumption becomes $p(a|s)∝\\exp(Q^*(s, a))$ [1]. With a discount factor of 0, the action probability $p(a|s)$ is given by Eq. (2). The loss function then becomes $L(θ) = \\sum \\log P(a|s, θ)$.\n\n**(2) MoE** consists of a gating network $α()$ and $K$ experts $p_1(),\\ldots,p_k()$. It can be indicated as $p(y|x) = \\sum_k α(x)p_k(y|x)$.  We model the RL policy as an MoE as stated in Eq. (4), with each expert corresponding to an action probability function as shown in Eq. (5). The IRL loss function for each expert is $L(θ_k) = \\sum \\log p(a|s, θ_k)$, which aligns with the M-step goal in the EM algorithm as stated in Eq. (11). Thus, it optimizes the IRL policy using the EM algorithm.\n\n[1] Maximum entropy inverse reinforcement learning\n\n**Q6: No code is provided.**\n\n**A6:** Thank you for your valuable suggestion. Please see Q2 in the global rebuttal.\n\n**Q7: Wrong description about “Threat model”.**\n\n**A7:** Thank you for your correction. \"Threat model\" should be replaced with \"Target model\".", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
**Q1: The complexity and scalability analysis of the proposed model.**

**A1:** Thank you for your valuable suggestion. Please refer to Table I in the attached PDF, where we detail the time complexity and runtime of the MoE-BiEntIRL, alongside two baseline models. Herein, we will present and discuss these specifics.

**(1) Time Complexity Analysis**

- **The time complexity of MoE-BiEntIRL**. The three principal stages of MoE-BiEntIRL are as follows:
  - Attack: It conducts $T$-step attacks. Each attack step requires feature updates for the involved subgraphs and nodes, including a forward pass on the target model. For the $L$-layer GCN as the target model, the time complexity of the forward pass is approximately $O(LN_{\text{edges}}d + LN_{\text{nodes}}d^2)$, where $N_{\text{nodes}}$ and $N_{\text{edges}}$ denote the numbers of nodes and edges in the input graph, and $d$ is the feature dimension.
  - Reward Acquisition: The reward is estimated with the IRL module. The time complexity for an episode is $O(NTKd(S+K))$, where $N$ is the number of expert trajectories, $T$ is the trajectory length, $K$ is the number of experts, $d$ is the feature dimension, and $S$ is the number of negative samples.
  - Policy Update:  With the LinUCB algorithm, the policy update time complexity is $O(d^2)$.
  - Overall, the total time complexity for an episode is approximately $O(TLN_{\text{edges}}d +TLN_{\text{nodes}}d^2+NTKd(S+K)+d^2)$.
- **The time complexity of baselines**. As in Table I , the complexities of the attack stage and policy update stage in the baselines are identical to those in the proposed model, differing only in the reward acquisition stage. The time complexity of the reward acquisition stage in baselines is:  
  - Apprenticeship Learning: $O(NTd)$;
  - EntIRL: $O(NTdS)$.
- **Summary**. Based on Table I, the time complexity of our proposal and the baselines primarily diverges during the reward acquisition stage. We introduces $K$ experts to manage multi-source attack trajectories with diverse motivations, thereby increasing the time complexity. Notably, the complexity associated with IRL reward acquisition is independent of the input graph size and hinges solely on the predefined $K$, typically ranging from 1 to 10, rendering the increased complexity manageable. Moreover, the main computational effort is concentrated in the attack stage, which further mitigates the impact of introducing multiple experts. Table I details the runtime of complete episodes and the IRL module. Despite the extended runtime of the MoE-BiEntIRL approach in the IRL module, it exerts negligible influence on the total runtime. Both the analysis of time complexity and experimental findings emphasize that the actual runtime is largely influenced by the attack stage. Therefore, the additional complexity introduced by employing multiple experts remains manageable.
- **Possible Solutions.** Here we propose the MoE-BiEntIRL-K, focusing on reducing $K$. It utilizes DBSCAN to determine $K$ and pre-cluster labels. By varying the intensity of clustering, we obtain coarse and fine pre-cluster labels. During the IRL process, we initially use the number of experts and pre-cluster labels corresponding to the coarse clustering. As the learning progresses, we increase the number of experts to align with the fine clustering. The initial expert parameters are determined by weighting the previous expert parameters with the current responsibility value. We applied this method on Weibo with $T=20$ and $N=3$. The values of $K$ determined through coarse and fine clustering were 5 and 26, respectively. The results indicate a 19% reduction (10.67s to 8.64s) in runtime while achieving 92% of the original IRL's performance level (19.936 to 18.381 in $ΔL_A$).

**(2) Scalability Analysis**

Based on the time complexity analysis, the scalability of the IRL module is robust, as it shows no direct correlation with the size of the graph. When applied to larger graphs, parameters such as $T$, $K$, $N$, and $S$ may indirectly increase due to the diverse nature of attacks within these larger contexts. As shown in Table I, the runtime of the IRL module shows minimal variation across datasets of varying sizes (e.g., Weibo with 10,280 nodes and Pheme with 2,708 nodes). As discussed in time complexity analysis, the predominant factor influencing runtime is the attack stage. Thus, in our humble opinion, the scalability of the proposed model is acceptable. 

**Q2: It is benefit to provide the clearer explanation of the algorithm, experimental setup and code. (Reviewer sELL, E98Q, M7DL)**

**A2:** Thank you for your suggestion. The algorithm and code are provided here.

**(1) Algorithm**: MoE-BiEntIRL

**Input:**

Expert demonstration set $D$, Number of experts $K$, Length of trajectories $T$, Number of episodes $E$, Gate function $α$, Reward function parameters $θ=[θ_1,..., θ_k]$, Learner policy $π$, Negative sample set $D'$, Responsibility matrix $γ$ , Inverse update episode set $\Lambda$

**Procedure:**

1. **For** $ e = 1,\ldots,E $:
   1. $ s = \text{env.reset}() $
   2. **For** $ t = 1,\ldots,T $:
      1. **If** $e\in\Lambda$:
         - $s',a=\text{PreciseSampleGuidance}(D)$
         - $ r = \text{MaxReward}() $
      2. **Else**:
         - $s',a=\text{env.step}(s,π)$
         - $ r = \text{ObtainReward}(α, s, a, θ) $ as Eq.~(14)
      3. $ \pi = \text{UpdatePolicy}(s, a, s', r) $
      4. $ s = s' $
   3. $ \gamma = \text{CalculateResponsibility}(α, D, D', θ) $ as Eq.~(8)
   4. **For** $k = 1,...,K$:
      1. **If** $e \in \Lambda$:
         - $θ_k = \text{InverseUpdate}(α,D,θ_k)$ as Eq.~(15)
      2. **Else**:
         - $θ_k = \text{GradientAscent}(\gamma,D,D',θ_k)$ as Eq.~(12)
   5. $ α = \text{GradientAscent}(γ) $ with the loss as Eq.~(10)

- It requires to correct Eq.~(14) as $r_θ(s,a) = \sum\nolimits_{k=1}\nolimits^K α_k(s)θ_k^\top f(s,a)$.

**(2) Code and Experimental Setup** have been provided to the AC in an anonymized link.

Meta-review: This paper proposes a method to enhance the robustness of rumor detection models by using a mixture-of-experts approach within maximum entropy inverse reinforcement learning to reconstruct attack policies from adversarial samples, thereby improving the generation of adversarial samples and strengthening model defenses through adversarial training and data augmentation. All reviewers conclude that the proposed approach is highly novel, in particular the innovative application of a MoE approach combined with inverse RL to address adversarial attacks on GNNs. The reviewers also praised the explainability of the attack policy reconstructions, strong experimental results and clear representation. (Somewhat minor) issues were raised on complexity of the suggested approach, especially given that multiple components such as IRL, MoE and bidirectional updates which may complicate implementation, but the authors managed to address these concerns to a satisfactory degree. After author rebuttal, all reviewers unanimously recommended acceptance; the AC read through all reviews and exchanges between the authors and the reviewers and concurs with this recommendation. The novelty of the approach and the practical impact on rumor detection on social media are potentially intriguing to a broader audience at NeurIPS and the AC additionally recommends this paper to be highlighted as a spotlight at the conference.
Decision: Accept (spotlight)