Training Robust Graph Neural Networks by Modeling Noise Dependencies
Authors: Yeonjun In
Kanghoon Yoon
Sukwon Yun
Kibum Kim
Sungchul Kim
Chanyoung Park
Venue: NeurIPS 2025 poster ()
Keywords: robust gnn
graph noise
Primary area: deep_learning

Abstract: In real-world applications, node features in graphs often contain noise from various sources, leading to significant performance degradation in GNNs. Although several methods have been developed to enhance robustness, they rely on the unrealistic assumption that noise in node features is independent of the graph structure and node labels, thereby limiting their applicability. To this end, we introduce a more realistic noise scenario, dependency-aware noise on graphs (DANG), where noise in node features create a chain of noise dependencies that propagates to the graph structure and node labels. We propose a novel robust GNN, DA-GNN, which captures the causal relationships among variables in the data generating process (DGP) of DANG using variational inference. In addition, we present new benchmark datasets that simulate DANG in real-world applications, enabling more practical research on robust GNNs. Extensive experiments demonstrate that DA-GNN consistently outperforms existing baselines across various noise scenarios, including both DANG and conventional noise models commonly considered in this field.

Training Robust Graph Neural Networks by Modeling Noise Dependencies
Yeonjun In', Kanghoon Yoon', Sukwon Yun Kibum Kim', Sungchul Kim
Chanyoung Park
KAIST UNC Chapel Hill AAdobe Research
(yeonjun.in, in, ykhoon08, kb. kim, cy park) kc.kr
swyunθcs edu sukim@adobe.com com
Abstract
In real-world applications, node features in graphs often contain noise from various sources, leading to significant performance degradation in GNNs. Although several methods have been developed to enhance robustness, they rely on the unrealistic assumption that noise in node features is independent of the graph structure and node labels, thereby limiting their applicability. To this end, we introduce more realistic noise scenario, dependency-awer in node features create chain of noise dependencies that propagates the graph structure and node labels. We propose a novel robust GNN, DA-GNN, which cap- tures the causal relationships among variables in the data generating process (DGP) of DANG using variational inference. In addition, we present new benchmark datasets that simulate DANG in real-world applications, enabling more practical research on robust GNNs. Extensive experiments demonstrate that DA-GNN con- sistently outperforms existing baselines across various noise scenarios, including both DANG and conventional noise models commonly considered in this field. Our code is available at hhtts::/ // //t///gtttt//tt//////// www.com/oooo// yenn/yeonjuu jun in/torch- GNN
noise on graphs (DANG), where noise
Introduction
In recent years, graph neural networks (GNNs) have demonstrated remarkable achievements in graph representation learning and have been extensively applied in numerous downstream tasks However, in the majority of real-world scenarios, node features frequently exhibit noise due to various factors, leading to the creation of inaccurate graph representations [5] For instance, in user-item graphs, users may create fake profiles or posts, and fraudsters and malicious users may write fake reviews or content on items, resulting noisy node features. Recent studies have revealed the vulnerability of GNNs to such scenarios, highlighting the necessity to design robust GNN models against noisy node features.
To this end, various methods have been proposed to make a huge success in terms of model robustness (. These methods are founded on the independent node feature noise (IFN) assumption, which posits that noise in node features does not impact the graph structure or node labels. Under the IFN assumption (Fig. [b), for example, Bob's fake profile does not influence other nodes, which is also explained by the data generating process (DGP) of IFN (See Fig. 2[a) in which no causal relationships exist among the noisy node features X, graph structure A, and node labels Y.
However, we should rethink: In real-world applications, can noise in node features truly be isolated from influencing the graph structure node labels? Let explore this through
"ooresponding Author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Consider Bob, who introduces noisy node features by creating fake profiles or posts. Other users, such as Alice and Tom, may then connect with Bob based on his fake profile, resulting in noisy connections that contribute to graph struc- ture noise. Over time, these noises could alter the community associations of Alice and Tom, leading to noisy node labels. Such causal relationships among node features X, graph struc- ture A, and node label Y (i.c., t X. + X, and +
examples from social networks (Fig. D.
A) are depicted in Fig. b
This scenario underscore an important in- sight: In real-world applications, noise in node features may create a chain of noise dependencies that propagate to the graph structure and node labels. This highlights the pressing need for ro- bust GNNs capable of addressing such noise dependencies, been largely overlooked in current research. Since such noise dependencies are prevalent across a wide range of real-world applica- tions" in addition social networks, failing to address them can result in significant ro- bustness gaps and impede the development of more practical and robust GNN models. How- ever, we observe that existing robust GNN models indeed fail to generalize effectively in such noise scenario since they overlook the underlying relationships among X, A, and Y within the data generation process.
Edges
Nolsy odger
Community
Community
fake profiic
Take profilc
Bob
Bob
Bob
aspect that has
Alice
Tom
Alice
Tom
Alice
Tom
(a) Clean graph
(b) IFN
(c) DANG
Figure 1: Examples of DANG in social networks: IFN represents independent node feature noise. Un- der the IFN (b), Bob's s noisy features have no effect the graph structure or node labels. However, in DANG (c), Bob's noisy features can propagate, lead- ing to both structural noise in the graph and label noise.
To enhance the practicality of existing noise assumptions and robust GNNs, we newly in- troduce a dependency-awee aware noise on graphs (DANG) and propose dependency-awail bust graph neural network framework (DA- GNN) that directly models the DGP of DANG. We first illustrate the DGP of DANG as shown in Fig. b (c.f. See 3. More precisely, introduce three observable variables (i.e., X. A.
O Observable O Latent
Zy
ro-
A
(a) DG
(b) of
Figure 2: A directed graphical model indicating
DGP of (a) IFN, and (b) DANG.
and Y) and three latent variables (i.e., noise incurring variable e, latent clean graph structure Za. and latent clean node labels Zy), ), while defining causal relationships among these variables to represent the data generation process of DANG. We then devise deep generative model. DA-GNN, that directly captures the causal relationships among the variables in the DGP of DANG by 1) deriving a tractable learning objective based on variational inference (c.f. Sec 4.1 and addressing non-trivial technical challenges in implementing the learning objective (c.f. Sec 4.2). Moreover, to rigorously evaluate our proposed method, we propose both synthetic and real-world DANG benchmark datasets. In our experiments, demonstrate that DA-GNN effectively generalizes not only to DANG but also to other noise assumptions commonly considered in this field of research. This highlights DA-GNN's broader applicability compared to existing robust GNN models. In summary, the main contributions of our paper are as follows:
We examine the gap between real-world scenarios and the overly simplistic noise assumptions underlying previous robust GNN research, which constrain their practicality.
To achieve this, we introduce a more realistic noise scenario, DANG, along with a robust model, DA-GNN, improving their applicability in real-world settings.
DA-GNN addresses DANG by modeling its DGP, resulting in superior robustness in node classification and link prediction tasks under various noise scenarios.
We propose novel graph benchmark datasets that simulate DANG in real-world applications to evaluate robust GNNs under realistic and plausible noise conditions, thereby promoting practical research in robust graph learning.
Additional real-wor world examples demonstrating the practical existence of such noise provided in See

---

2 Related Work
2.1 Noise-Robust GNN
Noise-robust GNNs aim to train robust models under feature, structure, and/or label noise, but most existing approaches focus on only one type of noise.
Feature noise-robust GNN. AirGNN [5] identifies and addresses nodes with noisy features based on the hypothesis that they tend to have dissimilar features within their local neighborhoods. Conse- quently, this approach tackles the noisy node features while assuming that the structure of the input graph is noise-free.
Structure noise-robust GNN. RSGNN 7 aims to train a graph structure learner by encouraging the nodes with similar features to be connected. STABLE S removes edges with low feature similarity, learns node representations from the modified structure, and constructs a kNN graph as the refined structure. In summary, these methods tackle the noisy graph structure while assuming that node features are noise-free.
Label noise-robust GNN. Although there have been many label noise-robust GNNs 12 B 14 [5], all these methods are built on the assumption that either node features or graph structures are noise-free. For example, RTGNN (IO) uses small-loss approach [16], but nodes with noisy features or structures exhibit large losses, leading to inaccuracies of the approach. TSS mitigates label noise relying on the structural information, which can be noisy.
Multifaceted noise-robust GNN. SG-GSR [17] tackles multifaceted structure and feature noise by identifying a clean subgraph within noisy graph structure and augmenting it using label information. This augmented subgraph serves supervision for robust graph structure refinement. However, since noisy label information can compromise the augmentation process, SG-GSR relies on the assumption that node labels are free of noise.
In summary, each method assumes the completeness of at least one of the data sources, limiting their practicality.
2.2 Generative Approach
18 devises a generative approach model the DGP of instance-dependent label noise 19 However, extending this method to the graph domain introduces significant challenges. It requires handling additional latent variables and complex causal relationships, such as ZA. CA. A <- CA. A + X.
Y + A, and A + ZA. each posing non-trivial obstacles beyond the straightforward extension WSGNN 20 and GraphGLOW (21) utilize probabilistic generative approach and variational inference to infer the latent graph structure and node labels. However, they assume noise-free graphs, reducing effectiveness in real-world noisy scenarios.
3
Dependency-Awarr Noise on Graphs
3.1 Formulation
In this section, define new graph noise assumption, DANG, and its DGP. In Fig. 2bb). X denotes the node features (potentially noisy), Y denotes the observed node labels (possibly noisy), A denotes the observed edges (which may contain noise), and denotes the environment variable causing the noise. Zy represents the latent clean node labels, while Z does the latent clean graph structure encompassing all potential node connections. We give the explanations for each causal relationship within the DGP of DANG along with the examples in user graphs in social networks:
X +- Zy): and Zy are causes of X. For example, users create their profiles and postings (i.e., X)) regarding their true communities interests (i.c., Zy). However, if users decide to display fake profiles for some reason (i.c., e), e is a cause of the noisy node features X.
A + XX: ZA and X are causes of A. For instance, the follow relationship among users (i.e., A) are made based on their latent relationships (i.e., ZA). However. if a user creates fake profile (i.e., X), some irrelevant users may follow the user based on his/her fake profile, which leads to noisy edges (i.e., A).
Detailed explanation is outlined in Appendix
3

---

*A+ To provide a broader scope, we also posit that e is a potential cause of A. This extension is well-founded [22 23], as real-world applications often exhibit graph structure noise originating from various sources in addition to the feature-dependent noise.
Y (Zr, A): Zy, X, and A are causes of Y. To give an example, the true communities (or interests) of users (i.e., Zy) are leveraged to promote items to targeted users within community (4 To detect the communities, both node features and graph structures are utilized. However, if user has noisy node features (i.e., X) or noisy edges (i.e., A), the user may be assigned to a wrong community (or interest), which leads to noisy labels (i.e., Y).
For simplicity, we assume is not cause of Y. This assumption matches real-world scenarios where mislabeling is more likely due to confusing or noisy features rather than arbitrary sources [19]. In other words, label noise in graphs is predominantly caused by confusing or noisy features and graph structure (i.e., + (X, A)), rather than an arbitrary external factor (i.e., Y + E).
3.2 Discussion
1) Under DANG a graph does not contain any noise-free data sources. This point presents a non-trivial challenge for the existing robust GNN methods to tackle DANG, as they assume the completeness of at least one data source.
2) DANG is prevalent across diverse domains, including social, e-commerce, web, and biological graphs. Due space constraints, detailed statistical evidences and intuitive examples on the existence of DANG in real-world applications are provided in Appendix C.I and We acknowledge, however, that not all noise scenarios perfectly align with DANG. For instance, in non-relational domains such as molecular structures or protein- prottin interaction networks, the graph structure is fixed and unaffected by node feature noise. Nevertheless, we claim that such cases are rare compared to the broad applicability of DANG across widely studied graph domains, including social, e-commerce, web, and biological (cell-cell) networks.
3) DANG addresses the practical gap between real-world and the simplistic noise assumptions of previous works. By introducing the DANG, we examine the practical limitations of existing robust GNN methods and promote further practical advancements in this field.
4 Proposed Method: DA-GNN
In this section, we propose a dependency-awwan robust GNN framework (DA-GNN) that directly models the DGP of DANG, thereby capturing the causal relationships among the variables that introduce noise. First, we derive the Evidence Lower Bound (ELBO) for the observed data log- likelihood P(X, A, Y') based on the graphical model of DANG (Sec|4.1). Subsequently, we introduce a novel deep generative model and training strategy maximizing the derived ELBO to capture the DGP of DANG (Sec
4.1 Problem Formulation
Notations. We have undirected and unweighted graph G (V,E) where V {v1 .......> UN represents the set of nodes and & E V x V indicates the set edges. Each node v has the node features X; RD and node labels Y, {0, 10, where F is the number of features for each node and C indicates the number of classes. We represent the observed graph structure using the adjacency matrix A E NxN, where Aij if there is an edge connecting nodes v; and Uj, and Ai otherwise. Throughout this paper, +() indicates a cosine similarity function and p(-) represents the ReLU activation function.
Tasks: node classification and link prediction. In the node classification task, we assume the semi-supervised setting where only portion of nodes are labeled (i.c., Vz). Our objective is to predict the labels of unlabeled nodes (i.e., Dt) by inferring the latent clean node label Zy. In the link prediction task, our goal is to predict reliable links based partially observed edges by inferring the latent clean graph structure A It is important to note that, according to the DANG assumption, the observed node features, graph structure, and node labels may contain noise.
Learning Objective. We adopt the variational inference framework 25 18 to optimize the Evidence Nower-BOund (ELBO) of the marginal likelihood for observed data, i.c., A, Y), rather than

---

class
class
unlabeled
clean labeled
noisy labeled
feal. olean edges
edges
inferred edges
(a) Inference Encoders
(b) Generative Decoders
Regularized Edge Prodiction
Smoothed Edge Labe
(X1A)
Structure Infer.
ZA
ZA
Structure
Pu
erec-edge Pij
Ro. (2,
X
Generation Ply [AIX, Ea.
Lham
Latent Clean Graph
E
Edge
4A Festure similarity
Clean
prediction
lidihooo
DANG
(X,4)
Label Infor. 94, (ZylX.
Ldss-ont b
Prediction +
Label
Zy
rec-
X
Pa, (11xx by)
Noise Faw. Inter. 4o. (r,,
e 0.
Ex
Prediction
Label
(x,4)
Label Gen. (XK,,
Y Yde dess-dec
Y
Clean
Noisy Graph (X A, Y)
likelhooud
Ex
Zy
(O 1)
Figure 3: Overall architecture of DA-GNN. (a) With the noisy graph (X, A, Y) as inputs, we design the inference encoders (é1, 62 and Φ3) and regularizers (Chom- Lets-enc and Lg) to infer Za. Zy, CA. and cx. (b) Leveraging the inferred latent variables, we formulate the generative decoders (61, 02, and 0z) and reconstruction loss functions (Cres-odges Lree-feat, and Lels-dee) to capture the causal relationships that generate noise in the graph.
optimizing the marginal likelihood directly. Specifically, we derive the negative ELBO, i.e., CELBO. as follows:
LEBO
EZANgg (2AlX.A Beng (e1X.A.2y) [log(po, (A|X,e, Zx))] Erraos (c1x,A,7y) EZY ~og (x. [log(Pg Po. (X)c, Zy-))]
-Ezy Boy (Zr [log(pe, (X
kl(go, X A) (P(A))
Egy (A.)) (A (e|X, A, Zy)()((e))
kl(gs, (yy XX, A)) Alp(()))
where kl(-Il-) denotes KI. divergence. The derivation details are provided Appendix do indicates inference (encoder) network that approximates the posterior of latent variables, while pe indicates generative (decoder) network that models the likelihood of observed data given latent variables. Our objective is to find the optimal values of network parameters 82, 0₂) that minimize the value of LELBO- By doing so, the encoders and decoders are trained to directly capture the causal relationships among the variables that introduce noise. Consequently. it promotes the accurate inference of the latent clean node label Zy and latent clean graph structure ZA effectively perform the node classification and link prediction tasks even in the presence of DANG.
(Φ1, 62, Φ3 and 0 [0,,
4.2 Model Instantiations
In this section, present the details of the practical implementation and optimization of DA- GNN based on the learning objective, LELRO. The overall architecture and detailed algorithm of DA-GNN are provided in Fig 3 and Algorithm [T Appendix, respectively. The key challenge of the instantiation is how accurately infer the latent variables A Zy. and the presence of design the robust inference encoders (Fig ((a) noisy X, A, and Y. To alleviate the challenge. and generative decoders (Fig 3b)) with the corresponding regularizers (Fig ((a) and reconstruction losses (Fig bb)). Consequently, the encoders would be able to accurately infer the latent variables by capturing the causal relationships among the variables that introduce noise.
4.2.1 Modeling Inference Encoder
In this section, we describe the implementations of the encoders, i.e., di, dhs, and d2,, that aim infer the latent variables, i.c., Za, Zy, and respectively.
5

---

Modeling q6, (Z, A). The objective of modeling 96, (Z, .A) is to accurately infer the latent clean graph structure ZA that enhances the message passing of a GNN model. We obtain the latent graph A = {pcz) NxN, where Púj ((s(Zi, Z,)) and Z = GCN,, (X, A), and regularize Á based on the prior knowledge that pairs of nodes with high 7-hop subgraph similarity are more likely to form assortative edges [21 266 7 thereby encouraging to predominantly include such edges. This regularization is equivalent minimizing kl(go, (Z A)]pp [A)) in Eqn. However, computing Pij in every epoch is impractical for large graphs, i.e., ( To this end, we pre-define proxy graph based on the subgraph similarity, and compute P. as edge weights on the proxy graph. Please B for detailed information on implementation details.
refer to the Appendix
Modeling go, (e,(2y (Zy [X, A). The objective of modeling 9éa (Zy A) is to accurately infer the latent clean node label Zy. To this end, we instantiate the encoder Φb as a GCN classifier. Specifically, we infer Zy through = GCN (X, A) E NXC, We introduce the node classification loss Lels-ene = Eigye. CE(Y,, Y.). where CE is the cross entropy loss. To further enhance the quality of inference of Zy, we regularize Zy satisfy class homophily (27 by minimizing the KL divergence between the probability predictions Y of each node and its first order neighbors in A. The implemented loss function is given by:
EjEN, Pej K((
Lham
EjEN, Pij
NV
where N₁ denotes the set of first-order neighbors of node v within A. It worth noting that this regularization is equivalent to minimizing kl(gp, A)]]
in Equ. !
Modeling qo,, (e|x, A, Zy). To model 9ø2 (c) X, A, Zy), we simplify (e, A, Zy) into Idm (cx [X, Zy) and Ganz Xx, A), where cx and сa are independent variables that incur the feature and structure noise, respectively.
The objective of modeling Gozz (EA|X, A) is to accurately infer the structure noise incurring variable 4 that determines whether each edge is clean or noisy. To this end, we regard 6 as a set of scores indicating the likelihood of each observed edge being clean or noisy. To estimate the likelihood, we utilize small loss approach [[6]. Precisely, we compute the set of link prediction losses as {(1 - ((1-))) ((G,5) E E). where P.) represents the Piy value at the final epoch during carly-learning phase. Therefore, an edge with high pij value can be considered as a clean edge, and we instantiate EA as (i.j) E}.
To alleviate the uncertainty of a single training point's 's loss value, we adopt an exponential moving average (EMA) technique: p.j + EPT) + +1 (1- p) where Pf, indicates the value of P.j at the current training point, and & indicates the decaying coefficient fixed to 0.9. This approach is equivalent to minimizing (l X, A))p(ca)). where p(ca) is assumed to follow the same distribution as Torz ( A) but with lower variance.
For the encoder @221, we use an MI.P that takes X and Zy as inputs and infers cx. Additionally, we regularize p(Ex) to follow the standard multivariate normal distribution, which means that closed E
form solution of kl (1ez (ex X, Zy [I((x))) can be obtained L, = - E (1+Hog of -1² of) 28) where dg is the dimension of 6x- Note that these two regularization techniques are equivalent to minimizing Ez, Ezy~qag [g62 (E [X, A, Zy) [lp(())] in Eqn.
4.2.2 Modeling Generative Decoder In this section, we describe the implementations of the decoders, i.e., 0,, 02, and 03. that generate the observable variables, i.e., A, X, and Y, respectively.
Modeling Pe, (A ZA). The probability p(A[X, e, ZA) means the likelihood of how well the noisy edge A is reconstructed from the latent graph structure ZA along with and X. Hence, we aim to minimize EZA~go, Eerggo [log[pe, (A,X, ZA))] to discover the latent graph structure Z from which the noisy edge A is reconstructed given noise sources, X and We implement it as an edge reconstruction loss forcing the estimated latent structure Á to assign greater weights to clean edges and reduce the influence of noisy edges, which is defined as egec which is defined as Lree-edge:

---

N
Lree-edge
(
Pij)
(Pus - 0)2 (6.)EE-
Σ
(3)
8-
(FJ)EE
where & and - denote the positive edges and randomly sampled negative edges, respectively. To compute edec- we employ regularizations on both the predictions (i.e., Pig and labels (i.e., Dif)
since the observed graph structure A contains noisy edges incurred by X and e, which introduce inaccurate supervision.
More precisely, the regularized prediction P.5 defined as: Piy = 01pty (1 (1--00 (1--1)ss(X3 (X),
The main idea to penalize Pij when s(X, X,) is high, as the edge between vs and vy is potentially noisy due to the influence of noisy X. To regularize labels, we adopt label smoothing approach by Pij E [0.9, 1]. enhancing the robustness in the presence of noisy supervision. When an edge is regarded as noisy (i.e., with low p.)), ) its label is close to 0.9 while an edge considered clean (i.e.,
with high p()) has label close 1.
Modeling Po, (x),, c, Zy)). The term p(X|c, Zy) indicates how well the noisy node feature X reconstructed from the latent clean label Zy along with e. Hence, aim to minimize -Eerge, Ey [log(pe, (X]ee Zy] To do so, the decoder needs to rely on the information contained in Zy, which essentially encourages the value of Zy to be meaningful for the prediction process, i.e., generating X. It is implemented as a feature reconstruction loss Lree feat, where the decoder 0g composed of MLP that takes ex and Zy inputs and reconstructs node features. Note that the reparametrization trick (28) is used for sampling 6x that follows the standard normal distribution.
Modeling Po, [Y A, Zy). The term p(Y X, A, Zy) means the transition relationship from the latent clean label Zy to the noisy label of an instance, i.e., how the label noise was generated [8] For this reason, maximizing log(pe, (Y) A, Zy)) would let discover the latent true label Zy from which the noisy label Y is generated given an instance, i.e., X and A. Hence, we aim to maximize the log likelihood, which is implemented as minimizing node classification loss Lels Specifically, the decoder 03 is composed of GCN classifier:
Y dec GCN,, Pg (X, A, Y) N Note that such learning objective is equivalent to minimizing - -Ezy masy [Pog(Pe, (Y A, Zv))
Equ.
4.2.3 Model Training
The overall learning objective can written as follows and DA-GNN is trained to minimize Limat
Limal
Lets
X Lrev + Xx Crumm Crrew + Lets-dee + fp),
where A₁ and A2 are the balancing coefficients. A is fixed to 0.001. In our pilot experiments, Lree-feat- Lels-des and Lp terms have relatively minor impact on the model's performance compared the others. As a result, we have made a strategic decision to simplify the hyperparameter search process and improve the practicality of DA-GNN by sharing the coefficient Ag among these three loss terms.
5 Experiments
Datasets. We evaluate DA-GNY and baselines on five commonly used benchmark datasets and two newly introduced datasets, Auto and Garden, which generated upon Amazon review data [30 B1] to mimic DANG on e-commerce systems (Refer to Appendix E.2.2 for details). The details of the datasets given in Appendix E.
Experimental Details. We evaluated DA-GNN in both node classification and link prediction tasks, comparing with noise-robust GNNs and generative GNN methods. For thorough evaluation, we create synthetic and real-world DANG benchmark datasets, with details in Appendix [E.2] We also account for other noise scenarios, commonly considered in this research field, following 8 10]. Further details about the baselines, evaluation protocol, and implementation details can be found in Appendix
H.3
E.4 and respectively.
'The value 0.9 is selected following 29

---

Table I: Node classification accuracy (%) under synthetic DANG. OOM indicates out of memory on 24GB RTX3090.
Dattee
Setting
WSGNN
GraghGLLW
AIrGNN
ProtiNN
RSGINN
STABLE
IvvenNet
NKGINN
RIGINN
SG-GSK
DA-GNN
Cleam
$6.2.0.1
85:240.7
85.0.0.2
85.3.0.4
$6,210.5
16
86.240.0
86.2.0.2
16.2
85.740.1
86,210.7
Cora
DANG--106
DANG-50%%
80.72003
71.600.5
79.7402
79.240.5
71.5+0.8
74.5+0.1
79.6007
S1.9203
71.9+0.5
82.2207
74.3+0.3
65.2+1.7
80.74077
8100005
73.5+08
8188903
72.6415
76.140.2
82.740.1
78.2+9.3
81,920.6
DANG-500
$5.9e1.1
59.680.1
56.2+0.8
46.450
59,9505
02882.4
47.3
61.9144
00.9504
64.360.5
69.7510.6
Clean
76640.6
76 1,00
71 5.0.
72.6
75.8404
74. 66006
76.4005
75.0+1.3
76. 140.4
75 75.340.
77.3+166
Citeseer
DANG-1001
DANG-50%
63.3+0.7
728808
66 26.2700.
58 4
67 57.5
73.3
63.9.0.5
71.5
60.5+114
71.1404
61.240.6
71 91093
64.2e1.9
73.220.2
65.61..
74.240.5
65.611.6
74.3+099
5ANG-50%
53.480.6
45.860.6
50,0+0.5
53.3a0.2
55.320.4
54.721.7
47.211.1
52.66009
54.211.8
54.841.8
59.011.8
Clean
02.9+0.3
94 2
03.5+0.1
90 +0.1+
03.6+0.8
03,4+0
94. 4
9..3+1.7
91.3+0.6
94. 100
948-0.3
Photo
DANG- 10%
DANG-500%
51.9
83.921.8
88 A200.2
82..
67. 8+4.5
87.310.9
84.3.0.1
74.7
86.6+1
92.11002
92.2.011
8%Pe1D
89 ke20.2
92.610.
11.321.3
60.0=2222
59, 110.5
93/020.1
90.5
93,220.2
DANG-50%
31.925.6
45.4
S7. 8.0.7
48.9
75.642.6
8022+18
84 84.6204
$7.5a188
79.260.3
84.110
87.6.0.2
Clean
K3.1+3.1
91. 3a019
1.2
K3 9
91.150.1
9012=01
90. 90.1
87.5=1D
57.3+1.0
91 31.7
92.2
Comp
DANG-300
DANG-10%
48.525.8
75.0n1.3 2
B4.940.4
88 05000
76 8.8
59.210.9
72 0.0
16.9
S1.750.2
88, 1.0.7
804210
K5
84,840.5
87 6
74.363.5
85.7
77.011.5
85.9H0.1
80 80.560.5
84.540.4
96.920.3
89.
30,6e5..
80.1+0.5
44,1+14
43.3
73.9e2.3
688-=13
77,5+1.9
68.363..
78.644..
82.2500,
00M
00M
60.420.5
00M
67.49944
Arxiv
10%
DANG-50%
00M
00M
00M
00M
36 R
50.5+1.55
00M
0OM
ODM
00M
0OM
00M
58 1.2
47.
0OM
GOM
54,360-4
45.0:0.
00M
D0M
49.910.5
59.7
DANG-50S
00M
00M
26. 1+0.2
00M
ODM
00M
38.0+4.1
0DM
38,4+0.8
D0M
44.0=1.2
Table 2: Node classification (NC) and link prediction (L.) under real-world DANG (Accuracy for NC and ROC-AUC for LP).
Task
Distact|
Satting
WSGINN
GaphGLLO
AIGINN
PooGiN
RSGENN
STABLE
EvenNet
NRGNNN
RIGNN
SG-GSR
DA-GNN
NC
Auto
DANG
Clean
57.7
71,8+4,3
59.4008
77.el1.
69.5.08
53.9.0.1
63.2502
48.660.3
69.5en.
Sh.860.9
57.560.2
71.4409
57.162.1
73.4005
74.3+0.8
55.8&1.0
59.620.8
76-440.2
62.0g1.1
78.300.3
61.420.4
79.3e6t1
Gardea
Clean
DANG
$7,420.2
77.6e1).8
88.5209
78.1l1.5
78.361.5
66.1e1.
78.7.0.1
73.0m0.4
83.2+1.2
76.260.5
$4.210.5
77.243.3
R5.720.5
75.6a24
76.150.2
67.740.4
87.8
760060.
90.250.4
58.120.3
88.720.3
N0.200.8
LP
Anto
Clean
DANG
69.1
$1.8+0.1
86220.3
748800.
60.2=022
$7.900.4
56.720.5
74.8=0.3
87.2-08
65.0g0.
57,340.1
78.640.1
70.5.0.2
868e0.1
47..
76.6113
72.220.2
84-4H0.1
62.268.3
65.617.4
N8.280.3
73,64066
Gurden
Clean
DANG
84.6210.7
$4.710.2
90.1004
90.2.0.5
58.250.5
62.0g0.1
83.520.6
N5.3.0.5
91.220.4
91.2.0.5
85.089).
89.250.3 S5.240.2
900000.7
58.684.5
67 020.9
90.480.2
90-150.3
960087.2
89.263.8
92.620.2
92.420.4
5.1 Main Results
1) DA-GNN demonstrates superior robustness compared to baseline methods in handling noise dependencies represented by DANG. We first evaluate DA-GNN under synthetic DANG datasets. that DA-GNN consistently outperforms all baselines in DANG scenarios, especially when noise levels are high. This superiority is attributed to the fact that DA-GNN captures the causal relationships involved in the DGP of DANG, while the baselines overlook such relationships, leading to their model designs assuming the completeness of at least one data source. Moreover, we investigate the robustness under our proposed real-world DANG datasets, Auto and Garden, that we simulate noise dependencies within e-commerce systems. In Table we observe that DA- GNN outperforms the baselines under real-world DANG on both the node classification and link prediction tasks. This indicates that DA-GNN works well not only under artificially generated noise, but also under noise scenarios that are plausible in real-world applications.
2) DA-GNN also shows com- parable or better performance than baselines under other noise scenarios, commonly con- sidered in this research field.
Feature Noise
Structure Noise
Label Noise
Node Clas, Acc (96)
85.0-
80
80
82.5
70
Specifically, we evaluate the robustness of DA-GNN under commonly utilized node feature
GCA
BRGNN
SCN
56.309
GCN
ARGRM
80.0
AGW
AROWV
STOWN
30.058
60
RTGNN
05-
Clean
10%
30%
50%
Clean
10%
30%
50%
Clean
10%
30%
50%
noise [5, structure noise [8) and
Noise Rate (56
Noise Rate (%)
Naise Rate (56)
node label noise scenarios [9] on Cora dataser" Fl In Fig 4 we ob- serve DA-GNN shows consis- tent superiority or competitive performance compared to existing robust GNNs. We attribute the robustness of DA-GNN un- der the noise in node features to the graph structure learning module that accurately infers the latent graph structure ZA. The utilization of abundant local neighborhoods acquired through the inference
Figure 4: Node classification under node feature noise, structure noise, and node label noise scenarios, which are commonly con- sidered in robust GNN research field, on Cora dataset.
Additional results other datasets are outlined in Fig 10
and 12 Appendix.
8

---

of ZA enables effective smoothing for nodes with noisy features, leveraging the information within these neighborhoods. We attribute the effectiveness of DA-GNN under the noise in graph structures to inferring the robust latent clean graph structure. In other words, the inference of the latent clean graph structure Z assigns greater weights to latent clean edges and lower weights to observed noisy edges by employing regularizations on both the edge predictions and labels, thereby mitigating structural noise. For the noise in node labels, we argue that the effectiveness of DA- DA-GNN stems from the accurate inference of the latent clean structure. Specifically, the inferred latent node label Zy is regularized using the inferred latent structure Za to meet the homophily assumption (i.e., Ltom). Leveraging the clean neighbor structure, this regularization technique has been demonstrated to effectively address noisy labels [3].
Cora
Citeseer
3) DA-GNN outperforms all baselines under an extreme noise scenario. In addition to a single type of noise, we explore more challenging noise scenario where all three types of noises occur simultaneously. denoted as extreme noise. It is important to note that each type of noise does not affect the occurrence of the other types of noise, in contrast to DANG. In Fig 5 DA-GNN consistently outperforms the robust GNNs under extreme noise.
Node Clas. Acc (9%
80-
70-
70
45000
Avomi
STABLE
60-
STAALE
50
KeaRth
50
Kiteik
40
D6-0W
DA-CKN
Gean 10%
30%
50%
Clean 10%
3d%
50%
Extreme (%)
Extreme Noise (16
Figure 5: Node classification under extreme
noise scenario.
SUMMARY: DA-GNN has a broader range of applicability than the existing robust GNNs under various noise scenarios. Based on the above results, we assert that modeling the DGP of DANG offers significant advantages for robustness, both under DANG and independently occurring feature, structure, or label noise, as DA-GNN is inherently capable of handling each type of noise. In contrast, the baseline methods assume the completeness of at least one of the data sources, resulting in significant performance drop when the noise rate is high.
5.2 Ablation Studies on DA-GNN
Table 3: Ablation studies of various DGPs from Fig
Case 3 removes Y + (X, A): Case 2 additionally re- moves A + X; Case additionally removes A f 6, equivalent IFN (Fig
To emphasize the importance of directly capturing the causal relationships among variables in the DGP of DANG, i..., + A), A + X, and A + move them one by one from the graphical model of DANG (See Fig (b). and then de- sign deep generative models based on the DGPs in similar manner DA- -NGNNN The graphical models of the derived DGPs illustrated in Fig [ In Table 3 we observe that as more causal relationships removed from the DGP of DANG, the node classification performance decreases. Below, we offer explanations for this ob- servation from the perspective of model derivation.
Dataset
Setting
(a) Case
(b) Case
(c) Case
Proposed
Clean
81.610.4
84.810.4
86.210.2
86.2s0.7
DANG-1OR
774400.
77.3.0.3
832200.
82.9:0.6
Cora
DANG-30%
68.340.4
68.5w0.2
77.340.4
78.220.3
DANG-50%
55.2e0.2
16.1
68.7+0.3
69.7=0.6
Clean
76.7e0.9
76.8
76.540.9
77.3=0.6
Citeseer
DANG-1O9
DANG-30%
57.2x1.1
69.560.3
57.740.5
5+0.4
73.250.1
65 5u0.7
74.3=0.9
65.620.6
DANG-50%
49.2s0.5
48.750.2
57.612.5
59.0s1.8
Case
(0)
Figure 62 Graphical models of DGPs derived from DANG.
1) Removing Y f- AX, i... Fig ()), simplifies -Ezy [log(pe, (og(P,,(Y|X,,, A, Zy))] to -Ezy [log(po, (YlZy))] )]] This simplification hinders the accurate modeling of the label tran- sition relationship from Zy the noisy label Y, resulting in degradation of model performance under DANG.
2) Additionally, when excluding A +- X. i.e., Fig b).. the inference of Za and Zy simplified as follows: go, (ZA(X,A) A) to 46 AZ and Zo (ZylX, A) to Los [ZylX) Furthermore, the loss term -E -Ez Eengez [log(pe, e is also simplified to -Ez Eerge, [log(pe, (Ale, Z)))]. These simplifications significantly hinder the accurate infer- ence of ZA and Zy, resulting in a notable performance degradation.
3) Eliminating A + C, as in Fig 6 a). simplifies - -E - Be [og[pp, (Alc, ZA)) to -R2, Bewqyy [log(po, (A]ZA))), This simplification hinders the robustness of the inferred Za. since the simplified loss excludes label regularization from the model training process, ultimately resulting in performance degradation.

---

5.3 Complexity Analysis on DA-GNN
We provide both theoretical and empirical complexity analyses of training DA-GNN, Our findings show that DA-GNN achieves superior performance compared to baseline methods while maintaining acceptable training times. For detailed discussion and comprehensive results, refer to Appendix F.1
5.4 Sensitivity Analysis
We analyze the sensitivity our proposed method DA-GNN in terms of its hyperparameters A₁ X2. k. 0,, and y. Our observations indicate that DA-GNN consistently exhibit best performance regardless of their values. Among these, plays a critical role and requires some tuning. But, as the search space is relatively small, we consider this acceptable. For a more comprehensive discussion and detailed results, please see Appendix F.2
5.5 Robustness Evaluation under Variants of DANG
We analyze the robustness of DA-GNN across different variants of DANG by varying the hyperpa- rameter settings used in dataset generation. Specifically, in the generation process of our synthetic DANG, we have three variables: 1) the overall noise rate, 2) the amount of noise dependency (X + A, (X (A Y), and 3) the amount of independent structure noise (e + A). For the generation process of our rorldworld DANG, we have 1) the number of fraudsters (i.e., nodes with noisy features) and 2) the activeness of fraudsters (i.e., the amount of structure noise they introduce). As a result, label noise also increases accordingly, in proportion to the amount of generated feature and structure noise.
Detailed results in Appendix F3 show that DA-GNN consistently outperforms all baselines across varying levels of both synthetic and real-world DANG, underscoring its robustness and practical applicability under diverse noise conditions.
5.6 Qualitative Analysis on DA-GNN
We conduct qualitative analyses verify how well DA-GNN infers the latent variables e and ZA. For a detailed setting and results, please refer to Appendix F.4
6
Conclusion
This study investigates the practical gap between real-world scenarios and the simplistic noise assumptions in terms of node features underlying previous robust GNN research. To bridge this gap, we newly introduce more realistic graph noise scenario called dependency-aware noise on graphs (DANG), and present deep generative model, DA-GNN, that effectively captures the causal relationships among variables in the DGP of DANG. We also propose novel graph benchmarks that simulate DANG within real-worke applications, which fosters practical research in this field. We demonstrate DA-GNN has broader applicability than the existing robust GNNs under various noise scenarios.
7 Limitations and Future Works
Despite broader applicability of the DANG and DA-GNN, they do not perfectly cover all possible noise scenarios. One direction to enhance their practicality to incorporate X A, suggesting graph structure noise can inevitably lead to node feature noise. By doing so, broader range of noise scenarios could be addressed, further improving practical applicability. A detailed discussion this topic is provided in Appendix C.3
Acknowledgements
This work was supported by the Institute Information & Communications Technology Planning & Exaluation(IITPP) grant funded by the Korea government(MSIT) (RS-2022 (RS-2025-02334967),, IITP grant funded by the Korea government(MSTT) (RS-2022-1122015)), National Research Foundation of Korca(NRF) funded by Ministry of Science and ICT (RS-200 (0S-2022-NR068758),
10

---

References
[1] Liang Yao, Chengsheng Mao, and Yuan Luo. Graph convolutional networks for text classification. In Proceedings of the AAAI conference on artificial intelligence, volume 33, pages 7370-7377, 2019.
[2] Xiang Wang, Xiangnan Hc, Meng Wang, Fuli Feng, and Tat-Seng Chua. Neural graph collaborative filterin. In Proceedings of the 42nd international ACM SIGIR conference on Research and development in Information Retrieval, pages 165-174, 2019.
[3] Junghoon Kim, Yeonjun In, Kanghoon Yoon, Junmo Lee, and Chanyoung Park. Class label-aware graph anomaly detection. In Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, pages 4008-4012, 2023.
[4] Junghoon Kim, Junmo Lee, Yeonjun In, Kanghoon Yoon, and Chanyoung Park. Revisiting fake news detection: Towards lemporality-aware evaluation by leveraging engagement earliness. arXiv preprint arXiv:2411.1277,, 2024.
[5] Xiaorui Liu, Jiayuan Ding, Wei Jin, Han Xu, Yao Ma, Zitao Liu, and Jiliang Tang. Graph neural networks with adaptive residual, Advances in Neural Information Processing Systems, 34:9720-9733, 2021.
[6] Wei Jin, Tong Zhao, Jiayuan Ding, Yozen Liu, Jiliang Tang, and Neil Shah. Empowering graph representa- tion learning with test-time graph transformation. arXiv preprint arXiv:22 10.0220,,,3511, 2022.
[7] Enyan Dai, Wei Jin, Hui Liu, and Suhang Wang. Towards robust graph neural networks for noisy graphs with sparse labels. WSDM, 2022.
[8] Kuan Li, Yang Liu, Xiang Ao, Jianfeng Chi, Jinghua Feng. Hao Yang. and Qing He. Reliable representa- tions make a stronger defender: Unsupervised structure refinement for robust gnn. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 925-935, 2022.
[9] Enyan Dai, Charu Aggarwal, and Suhang Wang. Nrgnn: Learning label noise resistant graph neural network sparsely and noisily labeled graphs. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pages 227-236, 2021.
[10] Siyi Qian, Haochao Ying, Renjun Hu, Jingho Zhou, Jintai Chen, Danny Z. Chen, and Jian Wu. Robust training of graph neural networks via noise governance. In Proceedings of the Sixteenth ACM International Conference on Web Search and Data Mining, pages 607-615, 2023.
[11] Yuhao Wu, Jiangchao Yao, Xiaobo Xia, Jun Yu, Ruxin Wang, Bo Han, and Tongliang Liu. Mitigating label noise on graph via topologiaa sample selection. arXiv preprint urXiv:2403.0/944 2024.
[12] Xuefeng Du Tian Bian, Yu Rong, Han, Tongliang Liu, Tingyang Xu, Wenbing Huang, Yixuan Li, and Junzhou Huang. Noise-robust graph learning by estimating and leveraging pairwise interactions. arXiv preprint 07455100..0751,,22
[13] Ling-Hao Chen, Yuanshuo Zhang, Taohua Huang, Liangcai Su, Zeyi Lin, Xi Xiao, Xiaobo Xia, and Tongliang Liu. Erase: Error-resilient representation learning on graphs for label noise tolerance. In Proceedings of the 33rd ACM International Conference on Information and Knowledge Management, CIKM '24, page 270 280, New York, NY, USA, 2024, Association for Computing Machinery.
[14] Jun Xia, Haitao Lin, Yongjie Xu, Cheng Tan, Lirong Wu, Siyuan ii, and Stan 7. Li. Gnn cleaner: Label cleaner for graph structured data. IEE. Trans. Knowl. and Data Eng. 36(2):640 February 2024.
[15] Kaize Ding, Xiaoxiao Ma, Yixin Liu, and Shirui Pan. Divide and denoise: Empowering simple models for robust supervieee node classification against label noise. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 574-584, 2024.
[16] Bo Han, Quanming Yao, Xingrui Yu, Gang Niu, Miao Xu, Weihua Hu, Ivor Tsang, and Masashi Sugiyama. Co-teaching: Robust training of deep neural networks with extremely noisy labels. Advances in neural information processing systems, 31, 2018
[17] Yconjun In. Kanghoon Yoon, Kibum Kim, Kijung Shin, and Chanyoung Park. Self- Self-guided robust graph structure refinement. arXiv preprint arXiv:2402.1 11837, 2024.
[18] Yu Yao, Tongliang Liu, Mingming Gong, Bo Han, Gang Niu, and Kun Zhang. Instance-dependent label-noise learning under structural causal model. Advances in Neural Information Processing Systems. 34:4409 4420, 2021.
11

---

[19] Antonin Berthon. Bo Han, Gang Niu, Tongliang Liu, and Masashi Sugiyama. Confidence scores make instance-dependent label-noise learning possible. In International conference on machine learning, pages 825-836. PMLR, 2021.
[20] Danning Lao, Xinyu Yang, Qitian Wu, and Junchi Yan. Variational inference for training graph neural networks in low-data regime through joint structure-label estimation. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 824-834, 2022.
[21] Wentao Zhao, Qitian Wu, Chenxiao Yang, and Junchi Yan. Graphglow: Universal and generalizable structure learning for graph neural networks. arXiv preprint arXiv:2306.11264 2023.
[22] Nian Liu, Xiao Wang, Lingfei Wu, Yu Chen, Xiaojie Guo, and Chuan Shi. Compact graph structure learning via mutual information compression. In Proceedings of the ACM Web Conference 2022, pages 1601-1610, 2022.
[23] Bahare Fatemi, Layla El Asri, and Seyed Mehran Kazemi, Slaps: Self-supervision improves structure learning for graph neural networks. Advances in Neural Information Processing Systems, 34:22667 12688867-2228,, 2021.
[24] Xiaoxiao Ma, Jia Wu, Shan Xue, Jian Yang, Chuan Zhou, Quan Z Sheng, Hui Xiong, and Leman Akoglu. A comprehensive survey on graph anomaly detection with deep learning. IEEE Transactions on Knowledge and Data Engincering, 2021.
[25] David M Blei, Alp Kucukelbir, and Jon D McAuliffe. Variational inference: A review for statisticians. Journal of the American stutistical Association, 12(518))859 877, 2017.
[26] Yoonhyuk Choi, Jiho Choi, Taewook Ko, Hyungho Byun, and Chong- Kwon Kim. Finding heterophilic neighbors via confidence-basee subgraph matching for superviue node classification. In Proceedings of the 31 ACM International Conference on Information & Knowledge Management, pages 283-292 2022.
[27] Miller McPherson, Lynn Smith-Lovin, and James M Cook. Birds of a feather: Homophily in social networks. Annual review of sociology, 27(1):415 444, 2001.
[28] Diederik Kingma and Max Welling, Auto-encoding variational bayes. arXiv preprint arXiv: 2013.
[29] Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2818- 2826, 2016.
[30] Ruining He and Julian McAuley. Ups and downs: Modeling the visual evolution of fashion trends with one-class collaborative filtering. proceedings of the 25th international conference on world wide web. pages 107,517,000 2016.
[31] Julian McAuley, Christopher Targett, Qinfeng Shi, and Anton Van Den Hengel. Image-based recommen- dations on styles and substitutes. In Proceedings of the 38th international ACM SIGIR conference on research and development in information retrieval, pages 43-52, 2015.
[32] Ahmet Iscen, Jack Valmadre, Anurag Arnab, and Cordelia Schmid. Learning with neighbor consistency for noisy labels. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4672-4681, 2022.
[33] Jiaqi Ma. Weijing Tang, Ji Zhu, and Qiaozhu Mei. A flexible generative framework for graph-basse semi semi-supervised learning. Advances in Neural Information Processing Systems, 32, 2019.
[34] Jiaying Wu and Bryan Hooi. Decor: Degree-corrected social graph refinement for fake news detection. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 2582 2593, 2023.
[35] Stephanie C Hicks, F William Townes, Mingxiang Teng, and Rafael A Irizarry. Missing data and technical variability in single-cell ma-sequeneing experiments. Biostatistics, 19(4):562-578, 2018.
[36] Uri Shaham, Kelly Stanton, Jun Zhao, Huamin Li, Khadir Raddassi, Ruth Montgomery, and Yuval Kluger. Removal of batch effects using distribution-matchaa residual networks. Bioinformatics. 33(16)22539 25466.66.9-56.... 2017.
[37] Juexin Wang, Anjun Ma. Yuzhou Chang, Jianting Gong, Yuexu Jiang, Ren Qi. Cankun Wang, Hongjun Fu, Qin Ma, and Dong Xu. segnn is novel graph neural network framework for single-cell ma-seq analyses. Nature commanications, 12(1):1882, 2021.
12

---

[38] Zehao Xiong, Jiawei Luo, Wanwan Shi, Ying Liu, Zhongyuan Xu, and Bo Wang. segel: an imputation method for serna-seg data based graph contrastive learning. Bioinformatics, 39(3)bbtad098, 2023.
[39] Sukwon Yun, Junseok Lee, and Chanyoung Park. Single-cell ma-seq data imputation using feature propagation. arXiv preprint arXi::2307.10037 2023.
[40] Zhilin Yang. William W. Cohen, and Ruslan Salakhutdinov. Revisiting semi-supervised learning with graph embeddings, 2016.
[41] Oleksandr Shehur, Maximilian Mumme, Aleksandar Bojehevski, and Stephan Günnemann. Pitfalls of graph neural network evaluation. arXiv preprint arXiv: 1.05668 2018
[42] Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. Open graph benchmark: Datasets for machine learning graphs. Advances neural information processing systems, 33:22118 22133, 2020.
[43] Wei Jin, Yao Ma, Xiaorui Liu, Xianfeng Tang, Suhang Wang, and Jiliang Tang. Graph structure learning robust graph neural networks. Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, pages 66-74, 2020.
[44] Runlin Lei, Zhen Wang. Yaliang Li, Bolin Ding, and Zhewei Wei. Evennet: Ignoring odd-hop neighbors improves robustness of graph neural networks. arXiv preprint 2rXiv22055.3889, 2022.
[45] Yeonjun In, Kanghoon Yoon, and Chanyoung Park. Similarity preserving adversarial graph contrastive learning. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 867-878, 2023.
13

---

NeurIPS Paper Checklist
The checklist is designed to encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No]. or [NA].
[NA] means either that the question is Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justification right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
The reviewers of your paper will be asked to use the checklist as one of the factors in their evaluation. While "[Yes] is generally preferable to "[No]" it is perfectly acceptable to answer "[No] provided proper justification is given (e.g., "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset used"). In general, answering "[No] or "[NA] is not grounds for rejection. While the questions are phrased in binary way, we acknowledge that the true answer is often more nuanced, please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS Paper Checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification: The abstract and introduction clearly state the paper's core contributions, including the proposed method, its motivation, and the evaluation setting. These sections accurately reflect the content of the main body, particularly in terms of the scope of the experiments and the novelty of the approach. The claims made are neither overstated nor misleading and are substantiated by the results and analysis presented in the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
14

---

Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Please refer Section 7
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-ter system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't It acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification:
We provide full derivation of our objective in Appendix A.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We provide our source code the anonymous github repository and detailed implementation details in Appendix E.5
15

---

Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g.. a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open- open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We provide our source code including data and running code in the anonymous github repository.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ ptaips.cc//uulic//uuu
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
16

---

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Please refer Appendix E.5
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We run all models multiple times and calculate the average and standard deviation to allow for the statistical comparisons.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula,
call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1-sigma error bars, but should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
Question:
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Answer: [Yes]
Justification:
We provide our GPU resource information in the experiment section,
Guidelines:
The answer NA means that the paper does not include experiments.
17

---

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics httpppp//aaarris..cccpull/iaiaaa
Answer: [Yes]
Justification: To the best of our knowledge, do not violate the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification:
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g.. deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
18

---

Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We properly cite and state the original papers and resources.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g.. website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of in the package should be provided. For popular datasets, paperssithcode com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re- re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
We provide the proper documentation in Appendix E.2
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
19

---

Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing. editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non sta-srdd components.
Please refer to LLM policy (nttps://neur/)) http://ppp...oooooeeeeeee/////// for what should or should not be described.
20

---

A Derivation Details of Evidence Lower BOund (ELBO)
We commence by modeling joint distribution P,X,A,Y) We assume that the joint distribution P(X, A, Y) is differentiable nearly everywhere regarding both and the latent variables (c, Za Zy Note that the generative parameter serves as the decoder network that models the distribution P(X, A, The joint distribution of P(X, Y) can be represented
Pa Po(X,,, A,Y) = J.J J Po Po(X, &, ZA. By Aed2
However, computing this evidence integral either intractable to calculate in closed form or requires exponential time. As the evidence integral is intractable for computation, calculating the conditional distribution latent variables po (c, ZA, Zy| X, Y) also intractable:
po(c, ZA, (x Po(X, A,,,,,AYYK A,Y,C, ZA, po P,(X, Y,Y
(6)
To infer the latent variables, we introduce an inference network Φ to model the variational distribution [e,c, ZA, Zy |X, Y), which serves approximation to the posterior po(c, A Zy | A, Y). To put it more concretely, the posterior distribution can be decomposed into three distributions determined by trainable parameters Φ1, Φ2, and Φ3. Based on the observed conditional independence relationships we decompose (e, A Zy X, A, Y) as follows:
(o,e, AA, Zy|x, = 96, A.) 46. (Zy |X, A,Y).
(7)
For simplicity, we introduce two additional assumptions. First, when the node features X and observed graph structure A are given, latent clean graph structure ZA is conditionally independent from the noise-incurring variable e, i... qo. XZ,|X,A, A. = gs. (Z A)). Second, when X and A are given, latent clean labels Zy is conditionally independent from the observed node labels Y, ie.. 90g (Zy XX, Y) = qsg (Xy|X, A). This approximation, known as the mean- field method, is
prevalent technique utilized in variational inference-basee methods 33 20
As result,
simplify Eqn. 7 as follows:
(e Za, Zy X A,Y) 9á1 (Z,|X, A)go, (e|X, A, Jos |x, (X,A) A).
8
To jointly optimize the parameter @ and we adopt the variational inference framework optimize the Evidence Lower-BOund (ELBO) of the marginal likelihood for observed data, rather than optimizing the marginal likelihood directly. Specifically, we derive the ELBO for the observed data log-likelihood P(X, A. Y). First, we factorize the joint distribution P(X, Z,, ZA,Zy> based on the graphical model in Fig. 2bb the main paper:
to
P,X, = PPPPPEAAPPPPPPP.
(9)
Thus, the conditional distribution Pa(X, Y|, Zy, can be represented as follows:
A, Z.. Pe, (X 4FAxx:/6622222322..2.22222222,,2
(10)
Recall that the conditional distribution (c, 2., |X, A, A) is factorized as in Eqn. Now,
derive the ELBO for the observed data log-likelihook P(X,A,Y):
Wee observe the following conditional independence relationships in Fig. b): (1) ZA A ZA A, < 2y, A.
21

---

log (X, A,Y) - -log J.J,,, J A, Za. 2x)dedZ
=log| /1/
Ao,X,A,Y,,,,, ZA, 7x) (o ZA, Zy A,,,
Ze 2A J2
A,, log Po A,, Zv)
=log (1222.2)))-00//222111.1
Zale,Za,Zy|X,A4 (y,
2 R1222,2r)--662222221.A44
ELBO
9o ZA. Zy (x, A,Y) p(e)p(ZZ)p(Zy))
(c (x
log Mole,ZA, Zy Zx|x, A,Y,
Pa, (A|X, Zn ZA) (X|c, Zy )o,, (YIX, AY, Zy)
+log
go(e, ZA. By A,
B4,22,la))-0((/2222311 log(po, (A|X, G, ZA))
+ log(pog (Xle, Zv)) log(oo, (Y| A, Zr))
((e))()A))(Zx)) + (4 log 96(c. ZA, Zy X, A,Y)
(11)
The last equation of Eq. 11 can be more simplified. We present the simplified results in Eqn. 12
13
14 and 15, where we abuse the notation Ezargo, (Z)]X.A), Be (AZx)) and Egy (y X,A)
as qo. legs and Jdg. respectively:
[log(po, (A|X, e, ZA)) Eno, Bno Boss [log(po. (A|X, c, Zx))]
Boo Boeg [log(pe, (A|X, e, Za))],
(12)
and
Bie,
(log(po, (X]e, Zx
Egg, Bag, Boos [log(po, (X|c, Zx
Egg Eges [log(pe, (Xle, Zy))],
(13)
and
2v).aa.2 XAA,Y) [log(en, (Y|X, A, Zy))
= Egg, Eyo, Ey,, [log(po, (Y]X, A, Zy))
= =Eges [log(res (YIX, A, Zy]
(14)
In similar way, the last term can be also simplified:
22

---

log p(c)p(ZA)p(2)
go A. Zy (X),
pl 2. )((p ()()
Bgg
Boon Buya
log 90h (ZalX, 16 (c A, Zy 1965 (Zy [X, A))
p(ZA)
log
p(e)
log
Egss Boos
900
(7 A)
a00 (c| (x,,x,44 A, 7x)
p(Zx)
Egas
log
4áa
(X, A)]
-k((0,
(ZalX,A)il AA)lp( [[a)) -Eg., Rgg [kl (clgossc(x, (c A, 2x)))(((())
kllgós A))p(\)))
(15)
We combine Eqn.
12
13
14
and get the negative ELBO, i.e., LELRO:
LELOO
RZ M (Z (Za(X.A) B Be (+)x, [log(po, (A|X, ZA))
X.A) [log(pe, (X|e, Zy:)]]
Ezrrnga (2 (X,A) [log(pe, (Y Zx))
+ kllsos (Zy X, A) |p
(Zx)) (g (Za(X, A))pp(())
+ Ezy aay a (Zy (X.A) [k:( (x|X, 4, Zy )lp()))))
(16)
B Details of Model Instantiations
B.1 Details of regularizing the inference Z
We regularize the learned latent graph Å based on the prior knowledge that pairs of nodes with high y-hop subgraph similarity are more likely to form assortative edges (1 26 71, thereby encouraging Á to predominantly include such edges.
However, computing Pij in every epoch is impractical for large graphs, i.e., O(N2). To mitigate the issue, we pre-define a candidate graph that consists of the observed edge set and a k-NN graph based the 7-hop subgraph similarity. We denote the of edges in the k-NN graphs as EZ. Then, we compute the Pij values of the edges in a candidate graph, i.c., & U E, instead of all edges in {i E V.j E V}, to estimate the latent graph structure denoted A. It important to highlight that obtaining EZ is carried out offline before model training, thus incurring no additional computational overhead during training. This implementation technique achieves similar effect as minimizing kl (Z X, A) (AA) while significantly addressing computational complexity
from O(N3) to O( U El), where N2 > 187 U
C Further Discussion on DANG
C.1 Statistical Analysis on Evidence of DANG
To provide empirical evidence of the DANG assumption in addition to intuition, we conduct statistical analysis on real-world news network. PolitiFact (34), where node features represent news content, node labels correspond to news topics or categories, and edges denote co-tweet relationships-ther is, instances where the same user tweeted both pieces of news. The network includes both fake and benign news, with fake news regarded as feature noise induced by malicious user intent (cx).
To investigate noise dependency patterns associated with the presence of fake news, We hypothesize that the presence of fake news (i.e., feature noise) leads to noisy graph structures and noisy node labels in news networks. Specifically, we assign a semantic topic to each news article as node label using k-means clustering over BERT embeddings of the article content. For each node in the graph,
23

---

Table 4: Statistics comparison between Fake news and Benign news.
Category
Mean
25%
50%
(Median)
75%
Fake news
1.330
1.402
1.465
1.494
Benign news
1.084
1.004
1.353
1.431
Mann-Whitney U test (p-value)
4.19e-25 25
we compute the Shannon entropy of the semantic topic distribution among its neighboring nodes. We then compare these entropy values between fake and benign news nodes.
In Table 4 descriptive statistics reveal that fake news nodes generally exhibit higher entropy than benign news nodes, suggesting that benign news tends to connect to semantically similar articles (homophilic), whereas fake news is more frequently connected semantically dissimilar articles (heterophilic). This observation aligns with common user behavior: people typically share news related to their interests, whereas fake news is often propagated indiscriminately, regardless of topical relevance [4. Furthermore, a non parammeeitiicc statistical test Mhinney U test) confirms that the difference in entropy values between fake and benign news statistically significant. These findings suggest that the presence of fake news (i.e., node feature noise) introduces noisy and heterophilic edges into the graph structure. Furthermore, model-based automated news topic prediction often performs poorly due to noise in both features and graph structures, ultimately resulting in incorrect label annotations.
In summary, these findings empirically support the noisy dependency scenario in real-world scenario where feature noise (i.e., fake news content) can propagate through the graph, generating noisy edges and noisy labels. This highlights the need for our work that explicitly model and mitigate such noise dependencies in real-world networks.
C.2 Intuitive Examples of DANG
These graphs feature nodes that may represent user's profile or posts, with follow relationship among users defining the graph's s structure. The node labels could denote the communities (or interests) of the users. In such scenarios, if users might create fake or incomplete profiles for various reasons, including privacy concerns, some irrelevant users may follow the user based his/her fake profile, which leads to noisy edges. Moreover, if a user has noisy node features or noisy edges, the user may be assigned to a wrong community (or interest), which leads noisy labels.
User graphs in social networks:
User graphs in e-commerce: Users might create fake or incomplete profiles for various reasons, leading to noisy node features. As result, products that do not align with the user's genuine interests could be displayed on a web or app page, encouraging the user to view, click on, or purchase these products. Consequently, users are more likely engage with irrelevant products, leading to noisy graph structure due to the user's inaccurate features. Moreover, this distortion in users' information and interactions can also alter their associated communities, resulting in noisy node labels.
Item graphs in e-commerce: Fake reviews on products written by a fraudster (i.e., noisy node features) would make other users purchase irrelevant products, which adds irrelevant edges between products (i.e., graph structure noise). Consequently, this would make the automated product category labeling system to inaccurately annotate product categories (i.e., label noise), relies the node features and the graph structure, both of which are contaminated.
Item graphs in web graphs: The content-based features of web pages are corrupted due poor text extraction or irrelevant information, which leads to noisy node features. In such case, the algorithm responsible for identifying hyperlinks or user navigation patterns might create incorrect or spurious connections between nodes, leading to noisy graph structure. Furthermore, if the features of the nodes are noisy, the algorithms that rely on these features to assign labels (e.g., classifying a web page news site or forum) may result in noisy node labels. Moreover, noises in the graph structure (e.g., incorrect links between web pages) can distort the relational information used by graph-based algorithms, leading to noises in the node labels.
24

---

Obervallo
O Labert
DANG
06) of -
Figure 7: A directed graphical model indicating DGP of (a) DANG, and (b) the case when adding causal relationship X.
Item graphs in citation graphs: In an academic citation network, nodes represent academic papers, edges represent citation relationships, and node features include attributes like title, abstract, authors, keywords, and venue. Recently, generative Al agents have created numerous fake papers with plausible but incorrect attributes, leading to noisy node features. These fake papers get indexed and resemble genuine ones, causing algorithms or researchers to mistakenly create citation links between real and fake papers based on content similarity or keywords, resulting in noisy graph structure. For instance, a well-crafted fake abstract may cause genuine papers to erroncously cite it. Fake papers corrupt classification algorithms, skewing topic distributions and distorting the citation graph. This affects metrics like citation counts, h-index calculations, and paper influence scores, propagating errors through algorithms that rely on the graph structure, ultimately leading to noisy node labels.
Biological Networks: addition to the user-item graphs, DANG manifests in the domain of single-cell RNA-sequencing (scRNA-seq). Specifically, in this graph the primary resource is cell-gene count matrix. A cell-cell graph is commonly employed for downstream tasks, where each cell and its corresponding gene expression are represented and the cell type is considered a node label. However, the node feature, representing gene expression derived from the cell-gene count matrix, often contains noise due to various reasons, such as the dropout phenomenon [5) and batch effect [36. Since the cell-gene count matrix is the main resource for generating the cell-cell graph (37
node and node feature, respectively,
38 39.. such noise acts significant obstacle in designing an effective graph structure. Additionally, cell types are annotated using transcripted marker genes, which serve as distinctive features characterizing specific cell types. Noisy node features, therefore, can lead to the misprediction of cell types (node labels). This issue of noise in node features the biological domain underscores the critical challenge real-world scenarios.
C.3 Extension of DANG
While the proposed DANG and DA-GNN demonstrate broader applicability compared to existing methods, they do not perfectly cover all possible noise scenarios. One potential direction to enhance their practicality is to incorporate the causal relationship X + A, which suggests that graph structure noise can inevitably lead node feature noise an occurrence that may manifest in certain real- world scenarios. For instance, consider social network where node features represent the content to which a user is exposed or interacts with (e.g., views, clicks, or likes), while the graph structure denotes the follower relationships In such scenario, if a user follows or is followed by fake accounts, the graph structure might incorporate noisy links (i.e., noisy graph structure). This, in turn, can impact the content to which users are exposed and their interactions (i.e., noisy node features), eventually influencing their community assignments (i.c., noisy node labels). In other words, the noisy node feature and noisy graph structure mutually influence the noise of each other, ultimately incurring the noisy node label. We illustrate its DGP in Fig 7b). Given that its DGP covers a broader range of noise scenarios that occur in real-world applications than DANG, we expect that directly modeling its DGP has the potential to enhance practical applicability. However, this is topic we leave for future work.
D Further Discussion on DA-GNN
While the implementation of DA-GI GA-GNN draws inspiration from the spirit of VAE 28 and CausalNL [8] we address complex and unique challenges absent in 288 18) Specifically, the incorporation of A necessitates handling supplementary latent variables and causal relationships, such as ZA. A, A c, A X, Y + A, +- Za, each posing non-trivial obstacles beyond their straightforward extension.
25

---

While [8] assumes that only causes X, DANG posits that also causes A, denoted as A t сΛ. Consequently, DANG requires a novel inference/regularizttoo approach for c which is not addressed in [8] presenting a distinctive technical challenge.
A simplistic uniform prior is employed to regularize the modeling of Zy in [8] However, upon close examination of the relationship Y <- A, we advocate for a novel regularization approach for Zy based on the principle of homophily. This method cannot be elicited through a straightforward application of 18 the graph.
By incorporating A, ZA, and their associated casualties, we address distinct technical challenges, specifically the inference/regularizaioo of ZA and the generation of A, which cannot be accommo- dated by a mere extension of [8] the graph. In particular, we utilize graph structure learning to model ZA. and frame the generation of A as an edge prediction task, incorporating novel regular- ization techniques for both edge prediction and label. Moreover, we regularize Za leveraging our novel prior knowledge to enhance the accuracy and scalability of inference.
We argue that these components are non-trivial to handle through straightforward application of [88 to the graph domain.
E
Details on Experimental Settings
E.1
Datasets
We evaluate DA-GNN and baselines on five existing datasets (i.e., Cora 40 Citeseer 40 Amazon
Photo and Computers 41), and ogbn-arxiv [2 and two newly introduced datasets (i.e., Amazon Auto and Amazon Garden) that are proposed in this work based on Amazon review data 30 31 to
mimic DANG caused by malicious fraudsters on e-commerce systems (Refer Appendix E.2.2 for details). The statistics of the datasets are given in Table These seven datasets can be found in these URLs:
Cora: https://ggthhbbcommccaaaaaaaaaat Citeseer: http://giinaaacmmoCCCaaaaaaaaaan
Photo: http://///ggooooeeememeeeerooooe
Arxiv: hutp://ghh.saunoaooolcccccohoopp
Auto: http://incalyyyusssccttduuu///mn
Garden: http://wwwanllyyuuoceddd/////uaa
Table 5: Statistics for datasets.
Dataset
Nodes
Edges
Features
Classes
Cora
2,485
5,069
1,433
Citeseer
2,1
3,668
3,703
Photo
7.487
119,043
745
Computers
13,381
245.778
767
10
Arxiv
169,343
1,166.243
128
Auto
8,175
13,371
300
Garden
7,902
19,383
300
E.2
Details of Generating DANG
E.2.1 Synthetic DANG
For the synthetic DANG settings, we artificially generate the noise following the data generation process of the proposed DANG scenario. First, we randomly sample subset of nodes yooisy (i.e., 10%, 30%, and 50% of the whole node set V). To inject node feature noise into the sampled nodes, randomly flip 0/1 value each dimension of node features X, from Bernoulli distribution with
26

---

probability p == + Ei= X,, which results in the noisy features X Roisy After injecting the feature noise, we generate feature-dependent structure noise (i.e., A f- X) and feature-dependent label noise (i.e., Y < (X, A)). For the feature-dependent structure noise, we first calculate the similarity vector for each node i; {s(X, X,)|u; V D2 E V) where s(:,,) is cosine similarity function, and select the node pairs whose feature similarity is top-k highest values. We add the selected node pairs to the original edge set &, which results in guolsy, To address feature-dependent label noise, we replace the labels of labeled nodes (i.e., training and validation nodes) with randomly sampled labels from Multinomial distribution, with parameters determined by the normalized neighborhood class distribution. Finally, for the independent structure noise (i.e., A + e), we add the randomly selected non-connected node pairs to the Emany, Detailed algorithm is provided in Algorithm
E.2.2 Real-world DANG
We have introduced and released two new graph benchmark datasets, i.e., Auto and Garden, that simulate real-world DANG scenarios on e-commerce systems. To construct these graphs, we utilized metadata and product review data from two categories, "Automotives" and "Patio, Lawn and Garden," obtained from Amazon product review data sources [30 B1]. Specifically, we generated a clean product-product graph where node features are represented using a bog-oofworrde technique applied to product reviews. The edges indicate co-purchase relationships between products that have been purchased by the same user, and the node labels correspond to product categories. We perform both node classification and link prediction tasks, which are equivalent to categorizing products and predicting co-purchase relationships, respectively.
We simulate the behaviors of fraudsters on real-world e-commerce platform that incurs DANG. When the fraudsters engage with randomly selected products (i.e., when they write fake product reviews), it would make other users purchase irrelevant products, which introduces substantial number of malicious co-purchase edges within the graph structure. Additionally, this activity involves the injection of noisy random reviews into the node features. To provide a more detailed description, we designated 100 uers as fraudsters. Furthermore, each of these users was responsible for generating 10 fraudulent reviews in both the Auto and Garden datasets. To generate fake review content, we randomly choose text from existing reviews and duplicate for the targeted products. This approach guarantees that the fake reviews closely mimic the writing style and content of genuine reviews, while also incorporating irrelevant information that makes it more difficult to predict the product category.
In e-commerce systems, to annotate the node labels (i.e., product categories), machine learning-base automated labeling systems are commonly utilized. Specifically, human annotators manually label a small set of examples, which is used as the training examples to the machine learning model. Subsequently, machine learning model is trained on these manually labeled product samples to automatically assign categories to other products. Therefore, the systems rely on the information about the products, e-g., reviews of products and co-purchase relationships, to assign categories to products. However, due to the influence of the fraudsters, the noisy node features (i.e., fake product reviews) and noisy graph structure (i.e.. co-purchase relationships between irrelevant products) may hinder the accurate assignment of the automated labeling systems, which leads to the noisy node label. To replicate this procedure, we selected 5 examples per category class, which is equivalent to manual labeling process. We then trained GCN model, leveraging the node features, graph structure, and manually labeled nodes, to predict the true product categories. Consequently, our set of labeled nodes composed of both manually labeled nodes and nodes labeled using the GCN model. Importantly, the labels of unlabeled nodes were left unchanged and still represented their actual categories. The data generation code is also available at httph::///// htte::://ttttttt.m com/ yemn:/yoojjuuuuu jun in/ ttttt/orch-----ee
We again emphasize that while existing works primarily focus on the unrealistic noise scenario where graphs contain only a single type of noise, to the best of our knowledge, this is the first attempt to understand the noise scenario in the real-world applications. Furthermore, we propose new graph benchmark datasets that closely imitate a real-world e-commerce system containing malicious fraudsters, which incurs DANG. We expect these datasets to foster practical research in nobse-robust. graph learning.
27

---

E.3 Baselines
We compare DA-GNN with a wide range of noise-robust GNN methods, which includes feature noise-robust GNNs (i.e.. AirGNN [5],, structure-noise robust GNNs (i.e., ProGNN [43] RSGNN 77
STABLE g and EvenNet 44 ) label noise-robust GNNs (i.e., NRGNN ( and RTGNN (0),, ) and
multifaceted noise-robust GNNs (i.e., SG-GSR [7]. We also consider WSGNN 20 and GraphGllow
21
that are generative approaches utilizing variational inference technique.
The publicly available implementations of basclines can be found at the following URLs:
WSGNN
20
http://jtthbcccmm//iiaaaassssuus
GraphGLOW 21
AirGNN http://gtttobccoo//tttooo///irAf
ProGNN
RSGNN
http://giitubbcoommm///ayaaaaaat
STABLE http://giihbbbcoom///llaapspsspp
EvenNet http://ggaabbbbooom////ccilliitn
NRGNN
http://ggiiabbbocm///yyyyaauauuu
RTGNN
SG-GSR http://gtthhbbcooooyyyjjnnnnnnnt
E.4
Evaluation Protocol
We mainly compare the robustness of DA-GNN and the baselines under both the synthetic and real-world feature-dependent graph-noise (DANG). More details of generating DANG is provided in See Additionally, we consider independent feature/structurr//bbell noise, which are commonly Specifically, for the feature noise [ we sample subset of nodes (i.e., 10%, 30%, and 50%) and randomly flip 0/1 value each dimension of node features X; from Bernoulli distribution with probability p = E X, For the structure noise, we adopt the random perturbation method that randomly injects non- conneceneeted node pairs into the graph g For the label noise, we generate uniform label noise following the existing works 10 9
considered in prior works in this research field 7 8 45 T0
We conduct both the node classification and link prediction tasks. For node classification, perform a random split of the nodes, dividing them into a 1:1:8 ratio for training, validation, and testing nodes. Once model is trained on the training nodes, we use the model predict the labels of the test nodes. Regarding link prediction, we partition the provided edges into a 7:3 ratio for training and testing edges. Additionally, we generate random negatives that are selected randomly from pairs that are not directly linked in the original graphs. After mode learning with the training edges, we predict the likelihood of the existence of each edge. This prediction is based on dot-product cosine similarity calculation between node pairs of test edges and their corresponding negative edges. To evaluate performance, we use Accuracy as the metric for node classification and Area Under the Curve (AUC) for link prediction.
E.5 Implementation Details
For each experiment, we report the average performance of 3 runs with standard deviations. For all baselines, we use the publicly available implementations and follow the implementation details presented in their original papers.
For DA-GNN, the learning rate is tuned from (0.01, 0.005, 0.001, 0.0005), and dropout rate and weight decay are fixed to 0.6 and 0.0005, respectively. the inference of ZA. we use 2-layer GCN model with 64 hidden dimension as GCN p, and the dimension of node embedding d1 is fixed to 64. The value calculating hhhp subgraph similarity is tuned from {0, 1) and generating k-NN graph is tuned from [0, 10, 50, 100, 300). In the inference of Zy. we use 2-layer GCN model with 128 hidden dimension as GCN In the inference of cx, the hidden dimension size of
ex, i.c., d2, is fixed to 16. In the inference of e, the carly-lcarning phase is fixed to 30 epochs. In
28

---

Table 6: Hyperparameter settings on DA GNNN for Table
Dataset
Setting
A
A2
81
Clean
0.01
0.003
0.003
0.1
300
DANG-10%
0.005
0.003
0.003
0.2
50
Cora
DANG-30%
0.001
0.003
0.003
0.2
100
DANG-50%
0.0005
30
0.003
0.3
Clean
0.0005
0.003
0.3
0.1
50
DANG-10%
0.005
0.3
0.003
0.3
10
Citeseer
DANG-30%
0.001
0.003
0.003
0.1
300
DANG-50%
0.001
0.003
0.003
0.1
300
Clean
0.01
0.03
0.3
0.1
10
DANG-10%
0.0005
0.03
0,3
0.1
10
Photo
DANG-30%
0.001
0.003
0.1
10
DANG-50%
0.0005
30
0.03
0.1
Clean
0.01
30
0.03
0.1
10
DANG-10%
0.01
0.3
0.03
0.1
10
Comp
DANG-30%
0.01
0.003
0.003
0.1
10
DANG-50%
0.0005
0.003
0.03
0.1
Clean
0.01
0.03
0.003
0.1
DANG-10%
0.01
0.003
0.03
0.1
Arxiv
DANG-30%
0.01
0.003
0.003
0.1
DANG-50%
0.005
0.03
0.1
the implementation of the loss term -EZ -0 LE-ggz [Pog(pe, (A[X, Za)il we tune the 0, value from (0.1, 0.2, 0.3). In the overall learning objective, i.e., Equ 4 x is tuned from 0.003, 0.03. 3, 30 ), 22 is tuned from 0.003, 0.03. 0.3 1, and À is fixed to 0.001. We report the details of hyperparameter settings in Table
For all baselines, we follow the training instruction reported in their paper and official code. For AirGNN, we tune À E [0.0, 0.2, 0.4, 0.6, 0.8) and set the others as mentioned in the paper for all datasets. For ProGNN,
the training script reported in the offical code since there are training guidance in the paper. For RSGNN, we tune a E (0.003, 0.03, 0.3, 3, 30), 3 E [0.01, 0.03, 0.1, 0.3, 1), np {0, 10, 100, 300, 400), and learning rate E (0.01, 0.005, 0.001, 0.0005) for all datasets. For STABLE, We tune t E (0.0, 0.01, 0.02, 0.03, 0.04), t2 E (0.1, 0.2, 0.3), E {1, 3, 5, 7, 11, 13). and E f-0.5, -0.3, -0.1, 0.1, 0.3, 0.6) for all datasets. For EvenNet, (0.1, 0.2, 0.5, 0.9) for all datasets following the training script of the official code. For NRGNN, we tune e (0.001, 0.01, 0.1, 1. 10), 3 E (0.001, 0.01, 0.1, 1. 10, 100), and learning rate (0.01 0.005, 0.001, 0.0005) for all datasets. For RTGNN, we tune E (1, 10, 25, 50, 100), thpse E (0.7, 0.8, 0.9, 0.95), E (0.03, 0.1, 0.3, 1), and 7 (0.01, 0.1). and learning rate (0.01, 0.005, 0.001, 0.0005). For WSGNN, we use the best hyperparameter setting reported in the paper since there are no training guidance in the paper. For GraphGLOW, we tune learning rate (0.001, 0.005, 0,01, 0,05), embedding size d E [16, 32, 64, 96), pivot number P E (800, 1000, 1200, 1400), E (0.1, 0.9), H (4, 6), E E {1, 2, a (0, 0.1, 0.15, 0.2, 0.25, 0.3), and p (0. 0.1, 0.15, 0.2, 0.25, 0.3). For SG-GSR, we tune learning rate E (0.001. 0.005, 0.01, 0.05), Ag Aup and As [1.0. 0.9, 0.7. 0.5, 0.3), and Aang E (0.1, 0.3, 0.5, 0.9].
tune X
F Additional Experimental Results
F1 Complexity Analysis
Theoretical Complexity. We present a theoretical complexity analysis on training DA-GNN. BE.GNN.TT The computational cost of encoding Zy and ex is identical to that of GCN and MLP forward pass. The regularization of Zy requires O(c- 18% U Encoding ZA requires O(d 117 U ET), which is significantly reduced by our regularization from O(d 2 The computation of encoding ca requires (d) E). Please note that this computation can be ignored since occurs only during the early learning phase. Decoding A requires O([E + +-I)). Decoding X and Y requires MIP and GCN forward pass. The primary computational burden stems from the encoding Z, and decoding A. Our regularization technique has alleviated this computational load, making DA-GNI more scalable.
29

---

Large Scale Graph. To demonstrate the scalability of DA-GNN, we consider a larger graph dataset, ogbn-arxiv 42.. clearyy illustrates that DA-GNN exhibits superior scalability and robustness in comparison to other baseline methods.
Table 7: Training time comparison on Cora dataset under DANG 50%.
Training time
AirGNN
ProGNN
RSGNN
STABLE
EvenNet
NRGNN
RTGNN
SG-GSR
DA-GNN
'Total (sec)
20.9
702.1
159.9
53.3
0.8
100.3
118.7
86.3
46.3
per epoch (5ec)
0.04
1.77
0.16
0.004
0.20
0.18
0.11
0.09
Training Time Comparison We compare the training time of DA-GNN with the existing noise robust graph learning baselines to analyze the computational complexity of DA-GNN. In Table we report the total training time and training time per epoch on Cora with DANG 50%. Note that since STABLE is a 2-stage method, we did not report the training time per epoch. The results show that DA-GNN requires significantly less total training time and training time per epoch compared to ProGNN, RSGNN, STABLE, NRGNN, RTGNN, and SG-GSR. This suggests that DA-GNN's training procedure is faster than that of most baselines while still achieving substantial performance improvements. Although AirGNN and EvenNet require much less training time than DA-GNN, their node classification accuracy is notably worse than other methods, including DA-GNN. This indicates that, despite their fast training times, they may not be suitable for real-world deployments. In summary, DA-GNN demonstrates superior performance compared to the baselines while maintaining acceptable training times.
F.2 Sensitivity Analysis
We analyze the sensitivity of the coefficient A and A2 in Eqn 0. and 7. To be specific, we increase A value from (0.0, 0.003, 0.03, 0.3, 3), A2 value from {0.0, 0.003, 0.03, 0.3). 0 from 10.1, 0.2, 0.3). and y from {0, 13. We then evaluate the node classification accuracy of DA-GNN under DANG.
In Fig aa) and 9 a), we notice that DA-GNN consistently surpasses the state-of-the-art baseline, EvenNet, regardless of the λ₁ value, demonstrating the robustness of DA-GNN Furthermore, we observe that the performance significantly drops when A = O. This highlights the importance of modeling the causal relationship A + (X, ZA) for robustness under DANG, as a is directly related to the loss term Ledge-ree, i..., EEz E. log(pe, (A|X, c, ZA))].
In Fig B(b) 9b)) observe that DA-GNN generally outperforms the sota baseline regardless the value of dạ. indicating the stability DA-GNN. Moreover, we can see a performance decrease when X2 O. This observation suggests that the regularization on the inferred la- tent node label Zy using the inferred latent structure Za effectively handles the noisy labels. This conclusion is drawn from the fact that X2 is directly linked to the loss term Lnoms i.e., kl(qo, (Zy |X, A))p((Z))
In Fig ((c) and (c), we analyze the hyperparameter sensitivity of k and observe that plays a critical role and requires some tuning. To recap the role of k we pre-define proxy graph based on subgraph similarity, where each node connects to k neighbors. We then compute á as the edge weights on this proxy graph, which corresponds to the regularization term minimizing kllqs, Z A) A.) Sensitivity to l highlights the importance of accurately inferring the latent graph structure ZA- This is expected, as using rich neighborhood information from Z enables robust message passing, which helps mitigate noise in the observed graphs. We restrict the search to just five values: [0, 10, 50, 100, 300). This narrow range consistently yielded effective performance across all seven datasets, suggesting that tuning & is not overly burdensome.
In Fig d) and Id), observe that DA-GNN consistently outperforms the srate-of-the-an base- line, EvenNet, across all values of f, demonstrating the robustness of the prediction regularization method in Eqr
In ((c) and ().). we observe that DA-GNN consistently surpasses the tfte-of-theeart bascline, EvenNet, across all values of 7, emphasizing the stability of regularizing the inferred Z in modeling q (Z A).
30

---

Photo dataset
Node Classsif Acc (%)
(a) A; Sensitivity
(b) A Sensitivity
(c) K Sensitivity
(d) 6 Sensitivity
(e) y Sensitivity
97-
60.
90-
SOTA B Baseline
SOTA Basaline
SOTA Baseline
SOTA Baseline
SOTA Baseline
8.5
0.003
0.005
Figure 8: Sensitivity analysis on d1 A2, O. and 7. We conduct the experiments on Photo dataset under DANG-30%
Computers dataset
Node Classit Acc (%)
(a) A Sensitivity
(b) Àg Sensitivity
(c) Sensitivity
(d) 0 Sensitivity
(e) Sensitivity
88
86-
8s
26-
86
SOTA Baseline
SOTA Baseline
SOTA Baseline
SOTA Baseline
SOTA Baseline
50
Figure 9: Sensitivity analysis on \ι 22, 0, and 7. We conduct the experiments on Computers dataset under DANG-30%
F3 Robustness Evaluation under Variants of DANG
F.3.1 Variants of Synthetic DANG
In the generation process of our synthetic DANG, we have three variables: 1) the overall noise rate, 2) the amount of noise dependency (X A, Y. A Y), and the amount of independent structure noise (e + A).
Table 8: Node classification results on DANG with increased noise dependency
Datuset
Setting
AirGNN
RSGNN
STABLE
EvenNet
NRGNN
RTGNN SG-GSR
DA-GNN
DANG-106 10%
78.3+0.3
79.0+0.1
79.5+0.4
76.9+1.2 1.2
78.640.5
78.8+0.5
78.5+0.2
79.8s0.2
Cora
DANG-30%
57.6+0.5
67.9*0.6
65.2+1.4
55.8#1.3
63.8+0.9
66.160.6
56.9+0.7
67.0+0.3
DANG-50%
40.1
49.410.9
45.7+1.2
40.5=1.0
47.5+0.5
48.1
40.1+1.2
51.620.9
DANG-10%
65.7+1.1
72.920.4
68.420.7
68. 68.820.6
69.7+1.0
69.820.0
70.3+0.5
72.7+0.3
Citescer
DANG-30%
57.2+0.9
63 63.3
57.240.1
57.2+0.5
59.6+0.7
60.1
62.0=0.9
64.920.6
DANG-50%
39.8+0.7
4..4+1.0
41.3+1.8
42.2+0.5
42.940.6
43.7+0.7
16.1
51,420.2
For the first variable, our experiments already addressed it by varying the noise rate from to 50.
For the second variable, we conduct an additional analysis by substantially increasing decreasing the degree of noise dependency. Specifically, we increase the number of structure noise edges caused by feature noise by approximately 4x, and similarly amplify the amount of label noise induced by both feature and structure noise by 4x. We also evaluate a setting where noise dependencies are completely removed this corresponds to scenario with independent feature and structure noise. As shown in Table & and Table 9 DA-GNN consistently outperforms all basclines on the strong presence of noise dependency, and shows competitive performance the weak presence of noise dependency.
For the third variable, we perform an additional analysis by doubling the amount of inde- pendent structure noise. We also evaluate the case where no independent structure noise is present. As shown Table 10 and Table I] DA-GNN consistently outperforms all baselines across both settings.
These results demonstrate that DA-GNN consistently outperforms other baselines under varying degrees of DANG, highlighting its practical applicability across diverse real-world noise conditions.
31

---

Table 9: Node classification results DANG without noise dependency
Dataset
Setting
AirGNN
RSGNN
STABLE
NRGNN EvenNet
RTGNN
SG-GSR
DA-GNN
DANG-105
43.1
83.9+0.6
83.940.4
84.0=0.5
83.8+0.2
84.8+0.2
84.8+0.1
84.8+0.1
Cora
DANG-30%
77.7+0.5
79.9+0.4
76.8+0.6
74.8+0.6
77.8+0.8
80.0+0.1
80.1+0.1
80.1+0.3
DANG-50%
66.9+2.6
72.7+0.6
70.3+1.8
61.3+3.4
69.140.8
73.240.6
72.0+0.2
75.4
DANG-10%
68.840.3
75.9:0.9
71.940.6
74.0=0.3
14.1
74.4+0.4
75.5+0.5
75.9:0.4
Citeseer
DANG-30%
63.640.2
70.7+0.5
67.340.2
67.9+0.3
69.7+0.3
69.4+0.6
72.0+0.4
71.5+0.3
DANG-50%
59.7+0.7
64.6+0.7
59.3+0.6
61.3+0.6
63.4.0.4
64.6+0.2
66.4+0.3
64.7+0.6
Table 10: Node classification results DANG without independent structure noise
Dataset
Setting
AirGNN
RSGNN
STABLE
EvenNet
NRGNN
RTGNN
SG-GSR
DA-GNN
DANG-10%
81.1#0,5
81.100.6
83.1+0.7
81.420.3
82.1+0.3
82.6#0.2
82,5+0.1
83,920.3
Cora
DANG-30%
73.9+1.7
73.6+0.3
76.9s0.3
69.7+0.7
76.340.4
74.8+0.9
77.7+0.3
79.620.6
DANG-50%
64.6+2.3
60.3+1.3
66.440.6
51.6+0.5
64.4+1.0
62.8+0.6
69.5+1.0
72.1+0.4
DANG-10%
68.3+0.6
71.8+0.7
72.4+0.9
72.8+0.1
73.1
73.7+0.2
74.5+0.4
74.7=0.1
Citeseer
DANG-30%
58.5#0.5
63.5
64.640.2
63.1=0.4
64.3+1.4
64.8+0.9
66.120.6
66.420.6
DANG-50%
54.3+0.2
55.920.3
58.1+10
51.2+2.1
56.7+0.2
56.620.9
59.320.6
60.3=1.2
F.3.2 Variants of Real-world DANG
We conduct experiment where independently double each of the following: (I) the number of fraudsters (i.e., nodes with noisy features) and (2) the activeness of fraudsters (i.c., the amount of structure noise they introduce) in our real-world DANG generation process. As result, label noise also increases accordingly, in proportion to the amount of generated feature and structure noise.
As shown in Table 12 DA-GNN demonstrates competitive performance and, in many cases, outper- forms other baselines under these intensified noise conditions.
Cora
Citeseer
Cora
Citeseer
Cora
Citeseer
16
Node Clas, Aoc
14
GEN
456
KiGAN STYALE
Ai-dery
rini
STARLS
90.0
SC-C5R
50 CSS
KTGU
ITCKN
CNN
10%
95%
50%
Clean
12% Feuturs Nakee (h))
T5%
Festure No 4 (S)
Structure Noizz 196)
Struture Node
Unioom Label Nokoe (S)
Un Labul Nose (5)
Figure 10: Node classification accuracy under independent feat. noise.
Figure 11: Node classification accuracy under independent stru. noise.
Figure 12: Node classification accuracy under independent label noise.
E44 Qualitative Analysis
In Fig [3(b), we analyze the inference of Z, by comparing the dis- tribution of Piş values, which constitute the estimated latent graph
(a) P Comparison
Demsity
Clean
structure A, between noisy edges and the original clean edges. It is evident that the estimated edge probabilities pig for noisy edges are predominantly assigned smaller values, while those for clean edges tend to be assigned larger values. illustrates DA-GNN effectively mitigates the impact of noisy edges during the pressage-passing process, thereby enhancing its robustness in the presence of noisy graph structure. This achievement can be attributed to the label regularization effect achieved through the accurate inference of ca- Specifically, as the observed graph structure contains noisy edges, the inaccurate supervision for Lre-edge impedes the distinction be- tween noisy edges and the original clean edges in terms of edge probability values Pij. However, the label regularization technique proves crucial for alleviating this issue, benefitting from the accurate inference of EA-
DMNG 50%
p value
(b) A. Comparison
10
Density
Clean Edges
Noisy Edges
0.6 Ag value
Figure 13: (a) Distribution of
pod values. (b) Distribution Pig values under DANG- 50%. Dashed lines are aver- ages. Cora dataset is used.
32

---

Table 11: Node classification results DANG with increased independent structure noise
Dataset
Setting
AirGNN
RSGNN
STABLE
EvenNet
NRGNN
RTGNN
SG-GSR
DA-GNN
DANG-109
78.9+0.7
81.6+0.3
80.9+0.5
78.9=0.3
79.9+0.4
81.8+0.3
81.4+0.2
82.5+0.2
Cora
DANG-30%
66.1
70.6+0.9
72.0+0.8
61.0=0.9
72.2+0.6
70.1
72.4+0.2
75.420.4
DANG-50%
47.3+0.5
56.7+0.2
57.9+1.6
42.1+2.1
58.840.6
55.6+0.5
61.2+1.5
65.420.6
DANG-10%
66.5+0.4
74.0:0.3
70.8+0.4
70.3+0.8
71.9+0.1
72.6+0.3
72.6+0.4
73.6+0.2
Citeseer
DANG-30%
58.0+0.2
63.8+0.6
62.3+1.8
60.1
61.6409
63.240.5
63.7+0.8
65.1
DANG-50%
49.4+0.6
55.1+0.3
51.7+1.7
45.9+0.7
50.840.8
52.0+1.1
54.2+0.2
55,4
Table 12: Node classification results on variants of real-world DANG
Setting
AirGNN
RSGNN
STABLE
EvenNet
NRGNN
RTGNN
DA
DANG doubled frauds
14.611.5
53.420.7
55.420.1
56.520.6
55.911.5
54.312.7
60.120.7
Auto
DANG w/ doubled structure noise
56.9+0.7
50.920.6
58.1s2.0
53.642,2
55.841.3
56.7840.8
55.6+1.0
Garden
DANG w/ doubled fraudsters
17.1
65.0=0.5
69.8+2.3
69.3+1.8
70. 70.8
70.6#0.9
71.920.6
doubled structure noise
69.4+1.3
72.0+0.5
72.440.9
71.0+2.
75.34004
74.440.2
We qualitatively analyze how well DA-GNN infers the latent variables 4 and Zz. In Fig 13 a), we investigate the inference of εд by comparing the distribution of Pij values estimated during training on clean and noisy graphs (DANG-50%) We observe that pij values estimated from the clean graph tend to be close to I, while those from the graph with DANG are considerably smaller. It suggests the inference of A was accurate, as the high values of ptz indicate that the model recognizes the edge (i,j) as clean edge.
Furthermore, to verify the distinction between the noisy and clean scenarios, We conduct a non- parametric analysis, Mann-Whitney U test, which require distributional assumptions. The results are as follows:
Fig a): Statistic=623338552200 p-value=0.0
Fig 13 b): Statistic=40277922..0, p-value=0.0.
Note that we found the scipy.stats package displays p-values as zero when they are extremely low. Therefore, we reported the corresponding test statistics with p-values. The results indicate highly significant differences between the groups.
F5
Comparison with the Naive Combination Existing Works
So far, we have observed that existing approaches fail to generalize to DANG since they primarily focus on graphs containing only single type of noise. A straightforward solution might be naively combine methods that address each type of noise individually. To explore this idea, we consider AirGNN the feature noise-robust GNN (FNR), RSGNN as the structure noise-robust GNN (SNR), and RTNN the label noise-robust GNN (LNR). We carefully implement all possible combinations among FNR, SNR, and LNR.
In Table 13 we observe that naive combination can improve robustness in some cases, but it may consistently yield favorable results. For example, combining FNR and SNR notably enhances robustness. However, when we combine all three (FNR, SNR, and LNR), which is expected to yield the best results, performance even decreases. This could be attributed compatibility issues among the methods arising from the naive combination. Furthermore, although some combinations improve robustness, DA-GN GNNN consistently outperforms all combinations. We attribute this to the fact that naively combining existing methods may not capture the causal relationships in the DGP of DANG, limiting their robustness. In contrast, DA-GNI successfully captures these relationships, resulting in superior performance.
33

---

Table 13: Comparison with the naive combination of existing noise-robust graph learning methods. FNR, SNR, and LNR denote the feature noise-robust, structure noise-robust, and label noise-robust graph learning methods, respectively. We consider AirGNN FNR, RSGNN SNR, and RTGNN as LSR methods.
Component
Cora
Citesecr
FNR
SNR
LNR
Clean
DANG 10%
DANG 30%
DANG 50%
Clean
DANG 10%
DANG 30%
DANG 50%
79.740.5
56.2s0.8
71.5a0.2
66.2s0.7
58.0a0.4
50.0a0.6
86.2+0.5
81.940.3
71.9+0.5
58.1
75.8+0.4
73.3+0.5
63.9+0.5
55.3+0.4
86.120.2
11.640.5
76.140.44
86.0=0.3
82.0+4.33
75.0+00.
68.840..6
75. 1+0.8
73.1
63.6+40.8
57,8+0.8
X5 02102
79.410.9
72.3+1.55
63.0210.4
76.720.3
74.3+0,9
64,82003
55.3400.5
67.0a0.9
DA-GNN
86. 86.240.7
82.910.6
78.2200.
69.7.00.6
77.340.6
74.340.9
65.6210.
59.0&18
Algorithm 1 Training Algorithm of DA-GNN.
1: Input: Observed graph 9 = (V,E), node feature X NxP. node label E R NxC
2: Initialize trainable parameters Φ1, Φ2 Øs. 02 0g
3: Initialize Pij to one vector 1.
4: Generate a k-NN graph E based on the 7-hop subgraph similarity
5: Pre-define candidate graph by E UE
6: while not converge do
7: /# Inference of AA */
8: Feed X and A to GCN,, to obtain the node embeddings Z
9: Calculate the P.j on the candidate graph E U based Z to obtain Á.
10: 1* Inference of Zy *1
11:
Feed and À to GCN to get Y 1* Inference of cx */
12:
13:
Feed X and Y to the MIP dg to get node embeddings that follow ( 1* Inference of <
15:
if early-learning phase then
16:
D f p(s ZZ Zz))
17:
P6
+ E + (1 E)pr,
18:
Convert P into Ttj end if
19:
20:
1* Generation of A #/
21:
Obtain an edge prediction Wij = 0ıūs + +1100)s(XX X,)
22:
1* Generation of X */
23:
Obtain the reconstruction of node features based on decoder MLPe, and its input and Y.
|* Generation of Y #/
25:
Obtain node prediction Yds based on classifier GCNa, and its input X and A.
1* Loss calculation */
27:
Calculate the objective function Lets-eme + > Lree-edge + Lrom + As Crec-teat + Lets-de + Cp)-
1* Parameter updates */
29:
Update the parameters Φ1, Ø2, d3. 22 0g to minimize the overall objective function.
30:
end while
31:
Return: learned model parameters Φ1, d2, dz, O2, 0g
34

---

Algorithm 2 Data Generation Algorithm of Synthetic DANG.
1: Input: Clean graph EV, node feature X RRNF,, node label Y E RN noise rate
17%
2: 1* Injection of feature noise */
3: Vnaisy &- Randomly sample a 17% subset of nodes
4: X X
5: for U; in Vuuisy do
6: Di 4 F 2 Xij
7: for j < to do
8: X noisy + BernoulliSample(s))
1j
9: end for
10: end for
11: /* Injection of feature-dependent structure noise */
12: Enoisy 3
13: for U; in Vuuisy do
S 0 R
15: for j - N do
16:
S, f s(x noisy
X,)
end for
18: Append 4t pairs of nodes with the highest values to gooisy
end for
20: /* Injection of feature-dependent label noise #/
21: Yoiisy + Y
22: for u; in VL do
23: if o has noisy feature or noisy structure then
24:
p, < Obtain normalized neighborhood class distribution of node
25:
Y MultinonialSamplepp))
26:
end if
end for
28:
** Injection of independent structure noise */
Randomly append pairs of nodes Enoisy
30: Return: noisy graph G = (V, gmoisy,, noisy node feature X "oiyy, noisy node label Yoiyy
35


Reviews:
[{"review_id": "VaLqqlA12d", "reviewer": "Reviewer_oKo2", "summary": "This paper proposes dependency-aware noise (DANG) on graphs to overcome the unrealistic assumption that noise in node features is independent of the graph structure and node labels, which creates a chain of noise dependencies that propagates to the graph structure and node labels. Based on this, the authors propose a novel robust GNN, DA-GNN, which captures the causal relationships among variables in the data generating process  of DANG using variational inference. Extensive experiments demonstrate that DA-GNN consistently outperforms existing baselines across various noise scenarios. It was an interesting and more realistic attempt.", "questions": "See weaknesses.", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n(1) This paper examines the gap between real-world scenarios and the overly simplistic noise assumptions underlying previous robust GNN research, which constrain their practicality.\n(2) This paper is well thought out, starting from the problem, to designing the noise dependency chain, and finally proposing a correlation graph neural network.\n(3) The article is well laid out with a clear focus and non-focus. Experiments are more adequate to validate the proposed model.\n\nWeaknesses:\n(1) Paragraphs 1, 2, 3, and 4 of the introduction are all describing unrealistic assumptions by examples and are overly redundant, please add some description of the relevant literature. Example description redundancy: more theory, literature, empirical description, less example description.\n(2) The generalizability and applicability of DA-GNN is mentioned in the introduction, please cite some references appropriately, such as “Unifying Homophily and Heterophily for Spectral Graph Neural Networks via Triple Filter Ensembles”.\n(3) The Formulation part of section 3 has word problems, e.g. “Y the observed node labels”. Please check the whole text carefully, if there are more similar problems in the revised version, no acceptance advice will be given.\n(4) Please explain how DANG works and its role in the following description (a) and Figure 3: (a) \"We propose a novel robust GNN, DA-GNN,which captures the causal relationships among variables in the data generating process (DGP) of DANG using variational inference.\" In addition, how are the noisy dependency chain of DANG generated and what is their association with the subgraph on the left side of Figure 3.", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank the reviewer for their time and thoughtful review of our paper, as well as for recognizing the contributions of our work. \n\n## Response to W1\n\nOur intention with the examples in Paragraphs 1–4 was to intuitively illustrate the limitations of existing assumptions and make the introduction accessible to readers from diverse backgrounds. However, we agree that the current version may place too much emphasis on illustrative examples at the expense of theoretical grounding or empirical context.\n\nIn the revised version, we will streamline redundant descriptions and expand the discussion of relevant literature and empirical motivations to better position our work within the broader research landscape. Specifically, we plan to incorporate the empirical findings referenced in our response to Reviewer KkeS, Question #1.\n\nWe appreciate your suggestion, which has helped us improve the clarity and balance of the introduction.\n\n---\n\n## Response to W2\n\nThank you for pointing this out. We agree that grounding the discussion of generalizability and applicability with appropriate references is important. To ensure that we fully understand your suggestion and incorporate the most relevant citations, we would greatly appreciate it if you could provide a bit more context on the types of works or specific aspects you believe should be highlighted—particularly in relation to the cited work “Unifying Homophily and Heterophily for Spectral Graph Neural Networks via Triple Filter Ensembles.”\n\n---\n\n## Response to W3\n\nWe sincerely apologize for the incomplete phrase. The line the reviewer pointed out should be modified to: \"In Fig. 2(b), 𝑋 denotes the node features (potentially noisy), 𝑌 denotes the observed node labels (possibly noisy), 𝐴 denotes the observed edges (which may contain noise), and 𝜖 denotes the environment variable that causes the noise.\" \n\nIn addition to this line, we carefully reviewed and corrected the rest of the text in Section 3. We will also conduct a thorough proofreading of the entire manuscript to ensure clarity, completeness, and grammatical correctness throughout. We greatly appreciate your attention to detail, which has helped us improve the overall quality and readability of the paper.\n\n---\n\n## Response to W4\n\n**About description (a).**\nThe description (a) means that DA-GNN is explicitly designed to model this dependency structure by introducing latent variables $Z_Y$, $Z_A$, and $\\epsilon$, and optimizing the evidence lower bound (ELBO) of the full joint distribution 𝑃(𝑋,𝐴,𝑌).  \nSpecifically, DA-GNN learns the encoder parameters for the latent variables, $\\phi=${  $\\phi_1, \\phi_2, \\phi_3$ }, and the decoder parameters for the observable variables, $\\theta=$ { $\\theta_1, \\theta_2, \\theta_3$ }, to maximize the ELBO.\nThrough this training process, the encoders and decoders are jointly optimized to model how the observed noisy graph is generated from both latent and observable variables, and to capture the causal relationships that induce noise dependencies. As a result, DA-GNN promotes accurate inference of the latent clean node labels $Z_Y$ and latent clean graph structure $Z_A$, enabling effective performance on node classification and link prediction tasks even in the presence of complex noise dependencies.\n\n**About Figure 3.**\nOn the left side of Figure 3, we illustrate both the latent clean graph and the observed graph affected by DANG. Importantly, this is not just a subgraph, but a depiction of an observed graph that includes unlabeled nodes, noisy node features, noisy edges, and noisy node labels.\n\nIn the latent clean graph, green and blue nodes each represent different classes. Nodes within the same class (e.g., all green or all blue) have similar features and tend to form edges with one another—this reflects a typical property of clean real-world graphs, where class-homophily governs both feature similarity and structural connectivity.\n\nDANG introduces noise into this clean graph by assuming that a latent variable 𝜖 perturbs some node features. In the observed graph, two nodes exhibit noisy features (shown as red blocks), corrupted due to 𝜖. Because these noisy features distort the similarity between nodes, noisy edges (shown as red solid lines) are formed between nodes of different classes (e.g., green and blue), as they now appear deceptively similar.\n\nFurthermore, this feature and structure noise can lead to label noise, where some nodes are incorrectly labeled—represented by circles with a minus sign. This cascading chain of noise dependencies lies at the core of the DANG formulation. It is elaborated in Section 3 (theoretical formulation), Appendix C.1 (conceptual examples), and Appendix E.2 (empirical implementation details). \n\nWe hope this response sufficiently addresses the reviewer’s concerns and clarifies the underlying motivation and formulation."}, {"review_id": "A80sdedIIC", "reviewer": "Reviewer_KCjc", "summary": "The authors study the practically relevant setting of feature, structure, and label noise for GNNs, where the different noise terms are not assumed to be independent. This addresses the shortcoming in prior work that relies on such simplifying assumptions. To alleviate this shortcoming and train a robust model, the authors propose a latent variational model that may correct noise. The authors demonstrate the empirical efficacy using 7 datasets and 10 baselines.", "questions": "1. To what extent are the clean features, edges, labels used for/available while training the model, if the authors study a transductive setting?\n1. Did the authors study different constructions of the noise model? E.g., make the feature noise dependent on the graph structure?", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "The authors address the important problem that previous attempts on modelling noisy features, graph structure, and labels relied on unrealistic assumptions (independence). The paper is well structured and easy to follow. The proposed model and its derivation looks largely sound to me but variation inference is not my research focus.\n\nMy main criticism is in the evaluation: \n1. Although adversarial robustness is not the key focus of the works, given how the authors phrase the problem, the evaluation should include adaptive adversarial evaluations as previous defenses have shown to be non robust if properly evaluated [1, 2].\n2. The evaluation of other noise types could be more extensive. Generally, their DANG model chooses a few constants that should be ablated.\n3. It is not clear if the evaluation is transductive/inductive. If following an transductive evaluation one has to be careful that the clean features, edges, labels are not being leaked during training. E.g., see [3] or [4]:\n>  transductive setting, i.e., test nodes (except for their labels) are available during training. In this case, defenders can simply memorize benign nodes and identify the injected nodes, making it an imperfect setting.\n\n[1] Tramer et al. “On Adaptive Attacks to Adversarial Example Defenses” NeurIPS 2020\n\n[2] Mujkanovic et al. “Are Defenses for Graph Neural Networks Robust?” NeurIPS 2022\n\n[3] Gosch et al. “Adversarial Training for Graph Neural Networks: Pitfalls, Solutions, and New Directions” NeurIPS 2023\n\n[4] Zheng et al. “Graph Robustness Benchmark: Benchmarking the Adversarial Robustness of Graph Machine Learning” NeurIPS 2021", "was_revised": true, "final_justification": "Adaptive attacks/evaluation is slightly suspicious since the attack is not very strong. Other concerns have been resolved and the paper may have impact/provide benefit to the respective subfield.", "rebuttal": "We sincerely thank the reviewer for their time and thoughtful review of our paper.\n\n## Response to W1\n\nIn response to the reviewer’s comment, we conduct experiments on adaptive attacks. Following [1], we implement adaptive PGD attacks on NRGNN, RSGNN, RTGNN, SG-GSR, and DA-GNN using a 10% attack budget.\nAs shown in the table below, DA-GNN demonstrates comparable or superior adversarial robustness against adaptive attacks compared to the baselines.\n\n|          |    RSGNN   |    NRGNN   |    RTGNN   |     SG-GSR     |     DA-GNN     |\n|----------|:----------:|:----------:|:----------:|:--------------:|:--------------:|\n|   Cora   | 82.68±0.41 | 80.73±0.23 | 81.90±0.32 | **83.23±0.78** |   82.56±0.17   |\n| Citeseer | 74.35±0.72 | 70.75±0.23 | 71.00±0.10 |   73.60±1.11   | **74.59±0.29** |\n\n[1] Are Defenses for Graph Neural Networks Robust?, NeurIPS 2022\n\n---\n\n## Response to W2\n\nIn the generation process of our synthetic DANG, we have three variables: 1) the overall noise rate, 2) the amount of noise dependency ($X \\rightarrow A, X\\rightarrow Y, A \\rightarrow Y$), and 3) the amount of independent structure noise ($\\epsilon \\rightarrow A$). \n- For the first variable, our experiments already addressed it by varying the noise rate from 0 to 50.\n- For the second variable, we conduct an additional analysis by substantially increasing or decreasing the degree of noise dependency. Specifically, we increase the number of structure noise edges caused by feature noise by approximately 4×, and similarly amplify the amount of label noise induced by both feature and structure noise by 4×. We also evaluate a setting where noise dependencies are completely removed—this corresponds to a scenario with independent feature and structure noise. As shown in Table 1 and Table 2, DA-GNN consistently outperforms all baselines on the strong presence of noise dependency, and shows competitive performance on the weak presence of noise dependency. \n\n**Table 1. Results on DANG with increased noise dependency**\n\n|          |           |  AirGNN  |   RSGNN  |  STABLE  |  EvenNet |   NRGNN  |   RTGNN  |  SG-GSR  |  DA-GNN  |\n|:--------:|-----------|:--------:|:--------:|:--------:|:--------:|:--------:|:--------:|:--------:|:--------:|\n|   Cora   | DANG-10\\% | 78.3±0.3 | 79.0±0.1 | 79.5±0.4 | 76.9±1.2 | 78.6±0.5 | 78.8±0.5 | 78.5±0.2 | **79.8±0.2** |\n|          | DANG-30\\% | 57.6±0.5 | **67.9±0.6** | 65.2±1.4 | 55.8±1.3 | 63.8±0.9 | 66.1±0.6 | 56.9±0.7 | 67.0±0.3 |\n|          | DANG-50\\% | 40.1±0.5 | 49.4±0.9 | 45.7±1.2 | 40.5±1.0 | 47.5±0.5 | 48.1±0.8 | 40.1±1.2 | **51.6±0.9** |\n| Citeseer | DANG-10\\% | 65.7±1.1 | **72.9±0.4** | 68.4±0.7 | 68.8±0.6 | 69.7±1.0 | 69.8±0.0 | 70.3±0.5 | 72.7±0.3 |\n|          | DANG-30\\% | 57.2±0.9 | 63.3±0.6 | 57.2±0.1 | 57.2±0.5 | 59.6±0.7 | 60.1±0.7 | 62.0±0.9 | **64.9±0.6** |\n|          | DANG-50\\% | 39.8±0.7 | 49.4±1.0 | 41.3±1.8 | 42.2±0.5 | 42.9±0.6 | 43.7±0.7 | 46.1±1.3 | **51.4±0.2** |\n\n**Table 2. Results on DANG without noise dependency**\n|         |           |  AirGNN  |     RSGNN    |  STABLE  |  EvenNet |   NRGNN  |     RTGNN    |    SG-GSR    |    DA-GNN    |\n|:--------:|-----------|:--------:|:------------:|:--------:|:--------:|:--------:|:------------:|:------------:|:------------:|\n|   Cora   | DANG-10\\% | 83.1±0.4 |   83.9±0.6   | 83.9±0.4 | 84.0±0.5 | 83.8±0.2 | **84.8±0.2** | **84.8±0.1** | **84.8±0.1** |\n|          | DANG-30\\% | 77.7±0.5 |   79.9±0.4   | 76.8±0.6 | 74.8±0.6 | 77.8±0.8 |   80.0±0.1   | **80.1±0.1** | **80.1±0.3** |\n|          | DANG-50\\% | 66.9±2.6 |   72.7±0.6   | 70.3±1.8 | 61.3±3.4 | 69.1±0.8 |   73.2±0.6   |   72.0±0.2   | **75.4±0.0** |\n| Citeseer | DANG-10\\% | 68.8±0.3 | **75.9±0.9** | 71.9±0.6 | 74.0±0.3 | 74.1±0.7 |   74.4±0.4   |   75.5±0.5   | **75.9±0.4** |\n|          | DANG-30\\% | 63.6±0.2 |   70.7±0.5   | 67.3±0.2 | 67.9±0.3 | 69.7±0.3 |   69.4±0.6   | **72.0±0.4** |   71.5±0.3   |\n|          | DANG-50\\% | 59.7±0.7 |   64.6±0.7   | 59.3±0.6 | 61.3±0.6 | 63.4±0.4 |   64.6±0.2   | **66.4±0.3** |   64.7±0.6   |\n\n\n- For the third variable, we perform an additional analysis by doubling the amount of independent structure noise. We also evaluate the case where no independent structure noise is present. As shown in Table 3 and Table 4, DA-GNN consistently outperforms all baselines across both settings.\n\n**Table 3. Results on DANG without independent structure noise**\n\n|          |           |  AirGNN  |   RSGNN  |  STABLE  |  EvenNet |   NRGNN  |   RTGNN  |  SG-GSR  |    DA-GNN    |\n|:--------:|-----------|:--------:|:--------:|:--------:|:--------:|:--------:|:--------:|:--------:|:------------:|\n|   Cora   | DANG-10\\% | 81.1±0.5 | 81.1±0.6 | 83.1±0.7 | 81.4±0.3 | 82.1±0.3 | 82.6±0.2 | 82.5±0.1 | **83.9±0.3** |\n|          | DANG-30\\% | 73.9±1.7 | 73.6±0.3 | 76.9±0.3 | 69.7±0.7 | 76.3±0.4 | 74.8±0.9 | 77.7±0.3 | **79.6±0.6** |\n|          | DANG-50\\% | 64.6±2.3 | 60.3±1.3 | 66.4±0.6 | 51.6±0.5 | 64.4±1.0 | 62.8±0.6 | 69.5±1.0 | **72.1±0.4** |\n| Citeseer | DANG-10\\% | 68.3±0.6 | 71.8±0.7 | 72.4±0.9 | 72.8±0.1 | 73.1±0.3 | 73.7±0.2 | 74.5±0.4 | **74.7±0.1** |\n|          | DANG-30\\% | 58.5±0.5 | 63.5±0.9 | 64.6±0.2 | 63.1±0.4 | 64.3±1.4 | 64.8±0.9 | 66.1±0.6 | **66.4±0.6** |\n|          | DANG-50\\% | 54.3±0.2 | 55.9±0.3 | 58.1±1.0 | 51.2±2.1 | 56.7±0.2 | 56.6±0.9 | 59.3±0.6 | **60.3±1.2** |\n\n\n**Table 4. Results on DANG with increased independent structure noise**\n|          |           |  AirGNN  |     RSGNN    |  STABLE  |  EvenNet |   NRGNN  |   RTGNN  |  SG-GSR  |    DA-GNN    |\n|:--------:|-----------|:--------:|:------------:|:--------:|:--------:|:--------:|:--------:|:--------:|:------------:|\n|   Cora   | DANG-10\\% | 78.9±0.7 |   81.6±0.3   | 80.9±0.5 | 78.9±0.3 | 79.9±0.4 | 81.8±0.3 | 81.4±0.2 | **82.5±0.2** |\n|          | DANG-30\\% | 66.1±1.8 |   70.6±0.9   | 72.0±0.8 | 61.0±0.9 | 72.2±0.6 | 70.1±0.6 | 72.4±0.2 | **75.4±0.4** |\n|          | DANG-50\\% | 47.3±0.5 |   56.7±0.2   | 57.9±1.6 | 42.1±2.1 | 58.8±0.6 | 55.6±0.5 | 61.2±1.5 | **65.4±0.6** |\n| Citeseer | DANG-10\\% | 66.5±0.4 | **74.0±0.3** | 70.8±0.4 | 70.3±0.8 | 71.9±0.1 | 72.6±0.3 | 72.6±0.4 |   73.6±0.2   |\n|          | DANG-30\\% | 58.0±0.2 |   63.8±0.6   | 62.3±1.8 | 60.1±0.3 | 61.6±0.9 | 63.2±0.5 | 63.7±0.8 | **65.1±0.5** |\n|          | DANG-50\\% | 49.4±0.6 |   55.1±0.3   | 51.7±1.7 | 45.9±0.7 | 50.8±0.8 | 52.0±1.1 | 54.2±0.2 | **55.4±1.2** |\n\n\nThese results demonstrate that DA-GNN consistently outperforms other baselines under varying degrees of DANG, highlighting its practical applicability across diverse real-world noise conditions.\n\n---\n\n## Response to W3\n\nWe followed **the transductive setting with training-time noise** in features, edges, and labels. There are no leaked clean features, edges, and labels in our setting because our setup fundamentally differs from **the transductive setting with test-time attack**, which is mentioned in [2] and [3]. Specifically, [2] claims that a model can achieve perfect robustness by memorizing the testing nodes and their clean structures, which are leaked during training.\n\nHowever, our setting assumes that the given graph already incorporates the noise before any training begins. The model never has access to the clean graph at any point. Hence, memorizing the noisy graph is not advantageous in achieving robustness. Instead, our model must learn to identify and handle noise patterns rather than memorize clean structures.\n\n[2] Gosch et al. “Adversarial Training for Graph Neural Networks: Pitfalls, Solutions, and New Directions” NeurIPS 2023\n\n[3] Zheng et al. “Graph Robustness Benchmark: Benchmarking the Adversarial Robustness of Graph Machine Learning” NeurIPS 2021\n\n---\n\n## Response to Q1\n\n\nClean features, edges, and labels are NOT available at all during training. Our model is trained entirely on the noisy graph - we add 10%, 30%, or 50% noise to features, structure, and labels before training begins, and the model never sees the clean version. This ensures no information leakage and forces the model to learn genuine denoising capabilities.\n\n---\n\n## Response to Q2\n\nWe have considered the scenario where structural noise in the graph influences the node features, as the reviewer suggested, and we discuss this in Appendix C.2. Exploring more diverse constructions of noise models—including those in which feature noise is explicitly dependent on the graph structure—remains an interesting direction for future work."}, {"review_id": "vPWxHv61u5", "reviewer": "Reviewer_Ar1L", "summary": "Typically when applying GNN models to real world graph data, the fact that we make noisy observations of some underlying \"true\" data or structure is ignored, and as a result there is a lack of robustness to these architectures when used out of the box. While there has been some prior work to try and handle this robustness, they assume that the node features and the underlying adjacency structure of the graph are independent, which is an implausible assumption in practice. (For instance, in a citation network node features could correspond to the paper, and so the adjacency structure will have some dependence on the similarity of the underlying papers to each other.) The authors of the current paper propose a more realistic data generating process to capture the noise in these networks, and develop a methodology making use of VAEs in order to perform inference on the graph. The authors also additionally introduce two new datasets to help evaluate robust inference methods for on noisily observed graphs.", "questions": "Questions:\n1. One part of the proposed data generating process which gives me some pause is the fact that the latent (or \"true\") node labels $Z_Y$ are causes of both $X$ and $Y$ within the DGP, with $X$ then an additional cause of $Y$. In the scenario where $Y$ is actually truly observed - so $Y = Z_Y$ in some sense - how should we think about the proposed DGP then? Can we just collapse $X$ and $Y$ together into a \"single $X$\" now? Or should $Z_Y$ actually be thought of as some noise, rather than as \"latent clean node labels\" as discussed in the introduction?\n2. As someone who is unfamiliar with the other methods considered within the experiments section, why do a lot of the models OOM on the arXiv dataset? More generally, I am curious about the inference time of each of the methods, and how these compare across the different models on larger graphs than the Cora dataset (which is very small). Do you have any comments on this?\n3. There are various points at which additional regularization are added to the models - for instance, regularizing $Z_A$ to incorporate mostly assortative edges, the regularization of $Z_Y$ to satisfy class homophily, and the label smoothing in the decoder. To what extent does the performance of your method depend on these? Do the methods you compare against perform similar regularization steps? I ask this as when in the scenarios without generative noise added, I don't see any a-priori reason why the current method should do better than existing ones - or even just a regular GCN. (I would be curious to see the experimental results also with a regular GCN applied, to just help illustrate why approaches like those proposed by the authors are needed.) I am trying to gauge the added value singularly from the particular generative model and inference approach proposed. Maybe this is something which can be inferred from Appendix F.2 and F.6, and I am just having a difficult time combining these together, in which case I would appreciate some further elaboration.\n4. Did you perform experiments with other ways of generating noise? For example, the provided example the inject noisy features into nodes flips nodes with the same probability as the number of set bits within the node vector. This means that e.g if a vector is mostly all ones, then it will become mostly all zeros afterwards, and so the extent to which a node vector can change is not equal across all nodes. What occurs if some fixed percentage of bits is flipped across all of the nodes?\n\nSome general remarks on the presentation of the paper:\n- Within Table 1, it appears that the bolded items only occur if the point estimates for the classification accuracy is the greatest, without incorporating the uncertainty under those estimates. It would help if there were some additional highlighting for the items where the classification accuracy has overlaps in terms of their error bars - for example between SG-SGR and DA-GNN on the DANG-10% Citeseer dataset example.", "limitations": "The authors have adequately addressed the limitations of their work.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths of the paper:\n- While the key idea in the paper is not that deep - in that it proposes a simple but realistic data generating process, and then derives the consequences of that from a modeling perspective - the method proposed is effective, and leads to improvements in performance over existing baselines. This is especially the case in scenarios where there is a relatively high amount of noise.\n- The discussion in the paper as it relates to the modeling approach and the experiments are very detailed and extensive, and cover a significant number of topics as it relates to: the training of the model; ensuring the scalability of the model inference; the effects of removing parts of the generative process and the corresponding drop in performance; hyperparameter studies and so on. I appreciate the extent to which the authors spent their time and effort in studying their method and illustrating it's performance and behavior.\n\nWeaknesses of the paper:\n- This is perhaps more a criticism of the datasets examined rather than the methodology itself, but with the exception of the arXiv dataset, the datasets examined are relatively small, with ~10K nodes or fewer (this including the two datasets introduced by the authors). It would be interesting to explore the performance of the method on some more larger graph datasets, such as the Reddit dataset (with ~200K nodes and ~100M edges). \n- Generally the presentation in the paper is a bit \"squashed\" - it tries to cover a lot of topics briefly and provide more details in the Appendix. It would help the readability of the paper if some areas had more time covered in the paper itself, and some were delegated to the Appendix entirely - for example the various details on regularization, as while important, makes it difficult to understand all the different parts of the model and how they are tied together. Moreover, it would help if some of the tables/figures were larger, or had larger versions within the Appendix themselves.", "was_revised": true, "final_justification": "As discussed in my overall review, I find that the overall contributions of the paper to be significant, in that they provide mechanisms for handling robustness within noisy graph labels and signals, which are demonstrated to be better than existing methods through substantial simulation experiments and studies. While not major concerns of mine which would prevent the acceptance of the paper, the authors of the paper have addressed some of my questions as it relates to the presentation of the paper, which will improve the readability of the paper overall to focus on the key messaging, and I appreciate being addressed by the authors.", "rebuttal": "We sincerely thank the reviewer for their time and thoughtful review of our paper, as well as for recognizing the contributions of our work. Below, we provide our detailed responses to the reviewer’s concerns and questions.\n\n## Response to W2\n\nWe agree that the current version may appear compressed, as it attempts to cover multiple aspects of our framework within the limited space. In response, we have revised the manuscript to improve clarity and readability by restructuring the content as follows:\n\n- We will streamline the main text to focus more clearly on the core components of our method, ensuring that the key ideas are presented with sufficient depth and continuity.\n\n- To reduce fragmentation and improve conceptual clarity, we will move several technical details on regularization—while still important—to the Appendix, and clearly reference them from the main text.\n\n- We will also enlarge key figures and tables in the main paper where space permits, and add larger, high-resolution versions of them in the Appendix to enhance legibility.\n\nWe believe these changes significantly improve the readability of our paper and hope they address the reviewer’s concern.\n\n---\n\n## Response to Q1\n\nIn our model, $Z_Y$​ represents the true latent label, while $Y$ is the observed label. The observed labels are provided in many research benchmark datasets, which are commonly treated as ground truth for supervised training and evaluation. However, our claim is that even these observed labels $Y$ may contain noise and thus do not reflect the true latent labels.\n\nFor example, consider an image of a wolf that is visually similar to a husky. A human annotator might mistakenly label it as a husky due to the visual resemblance. In this case, the observed label $Y$ is “husky,” but the true latent label $Z_Y$​ is “wolf.” The similarity in appearance (i.e., the node feature $X$) has caused incorrect labeling. At the same time, the fact that the true latent label is “wolf” explains why the image depicts a wolf. This kind of mechanism implies that $Z_Y$​ causes both $X$ and $Y$ in the data generating process, with $X$ further contributing to the generation of $Y$. Such a causal structure is well-aligned with the literature on instance-dependent label noise [1] and thus conceptually grounded.\n\nHowever, because benchmark datasets do not provide ground-truth latent labels or explicit annotations of label noise, we design DANG to simulate this realistic noise scenario and study its impact in a controlled setting.\n\n[1] Instance-dependent Label-noise Learning under a Structural Causal Model, NeurIPS 2021\n\n---\n\n## Response to W1 and Q2\n\nSeveral baseline methods encounter out-of-memory (OOM) errors on large-scale datasets such as ogbn-arxiv primarily due to their reliance on structure learning components. These methods often require computing an explicit 𝑁×𝑁 similarity matrix or graph refinement operations, which incur high memory overhead, where 𝑁 is the number of nodes. In contrast, our method avoids this bottleneck by approximating the regularization term $kl(q_{\\phi_1}(Z_A|X, A)||p(Z_A))$ efficiently (See Appendix B). This design significantly reduces the computational and memory cost, enabling DA-GNN to scale to large graphs without OOM issues.\nFurthermore, we conduct an inference time analysis on the arXiv dataset using only models that do not incur OOM errors. The results are as follows:\n- DA-GNN: 0.0599 sec\n- RTGNN: 0.0461 sec\n- AirGNN: 0.0346 sec\n- EvenNet: 0.0027 sec\n\nDA-GNN takes approximately 0.06 seconds for a single inference, which is comparable to RTGNN and AirGNN in terms of inference efficiency. Furthermore, we plan to include a larger-scale graph in our experimental setup to further assess the scalability of DA-GNN.\n\n---\n\n## Response to Q3 \n\nSome prior methods adopt regularization ideas similar to ours, but they typically apply only a subset of them or rely on different assumptions. For example, RSGNN employs a regularization approach similar to ours for $Z_A$, but it heavily depends on the assumption of strong feature smoothness. Furthermore, it does not incorporate other regularizations. The reason our model achieves strong performance even under clean settings is that our regularization components are not tailored solely for noisy scenarios. Regularizing $Z_A$ to favor assortative edges is closely related to graph structure learning, which has been shown to benefit GNN performance even when no noise is present. Similarly, our regularization on $Z_Y$ encourages class homophily, a widely accepted inductive bias in graph learning, and our decoder for $A$ applies label smoothing to prevent overfitting. These components work synergistically to improve generalization and robustness. Therefore, even in clean settings, DA-GNN outperforms baselines that do not fully leverage these forms of inductive bias.\n\n---\n\n## Response to Q4\n\nDue to the nature of bag-of-words features, most node features are very sparse, and cases where a node feature is mostly all ones—as mentioned by the reviewer—are extremely rare in real-world scenarios. If we were to flip a fixed percentage of bits based on high-bit-count nodes, this would lead to overly aggressive perturbation for the majority of nodes, which is unrealistic in practical settings. Conversely, if we set the fixed percentage based on low-bit-count nodes, nodes with richer features would receive almost no perturbation. However, since such high-bit-count nodes are rare, we expect the difference between the fixed-percentage approach and our current method to be minimal in practice.\n\nAdditionally, in datasets like arXiv that use numerical node features, we inject Gaussian noise with equal magnitude across all nodes. Even under this setting, DA-GNN consistently outperforms baselines, which further supports the robustness of our approach.\n\n---\n\n## Response to Q5\n\nWe reported standard deviations alongside point estimates, although for readability we boldfaced only the latter. We agree that including results of statistical significance tests could further clarify performance differences and will consider adding them in a future revision. We would also like to highlight that while this concern may arise under low noise rates, at higher noise levels, DA-GNN consistently outperforms baselines even when accounting for variance."}, {"review_id": "jX9zeGygV1", "reviewer": "Reviewer_KkeS", "summary": "This paper proposes DA-GNN, a robust graph neural network model designed to handle Dependency-Aware Noise on Graphs (DANG)—a realistic scenario where noise in node features affects both graph structure and labels. Unlike prior work assuming independent noise, DA-GNN models the full causal noise dependencies using a deep generative framework with variational inference. The authors introduce new benchmarks to simulate DANG and demonstrate that DA-GNN consistently outperforms existing robust GNNs across various noise types, including synthetic, real-world, and extreme noise scenarios.", "questions": "- How representative is the DANG assumption across diverse real-world domains beyond social networks and e-commerce? Can you provide empirical evidence—such as statistical analysis or real-world data studies, rather than intuition—that supports the prevalence of the causal relationships assumed in DANG in domains like biological networks, citation graphs, or recommendation systems? Without such support, the synthetic DANG settings constructed on citation networks in the experimental section seem to be an artificial formulation tailored to fit the proposed model.\n- The \"Auto\" and \"Garden\" datasets are generated using specific heuristics for fake reviews and label noise. How sensitive are your results to these design choices? Could the results be skewed by the data generation pipeline favoring DA-GNN?\n- DA-GNN involves multiple encoders, decoders, and regularization terms. What is the actual cost in terms of runtime/memory, especially for large-scale graphs such as ogbn-arxiv? How sensitive is DA-GNN to hyperparameter settings in low-resource settings?\n- In Fig.3, the font is too small and the layout is overly compact. It is recommended to stretch the figure horizontally and appropriately increase the font size. In addition, in the Inference Encoders section, is there a missing arrow from $Z_A$ to Noise Env. Infer.?\n- To what extent does the proposed method rely on the specific GNN architectures used in the encoder and decoder modules? For example, the encoders for inferring $Z_A$ and $Z_Y$, use GCNs, and the decoder for label prediction also adopts a GCN. Have the authors evaluated how performance is affected when substituting these GNN components with alternative architectures (e.g., GraphSAGE, GAT)? This would help clarify whether DA-GNN's robustness primarily stems from the causal modeling framework itself or from the specific choice of backbone GNNs. Additionaly, The low-pass filtering nature of GCN inherently imposes a homophily inductive bias on the encoding/decoding process. Could this lead to poor performance of the model on heterophilous graph datasets?\n- How does DA-GNN perform under varying levels of noise correlation or dependency strength in the DANG setting? While the paper evaluates robustness under different noise rates (10%, 30%, 50%), it is unclear how sensitive the model is to the strength of the dependency between feature noise and structure/label noise. For example, what happens if the correlation between noisy features and added edges is weak or inconsistent? A controlled study varying the dependency strength (rather than just the noise rate) would better validate the assumptions underlying DANG.", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "**Strengths:**\n- The paper is technically sound and presents a complete solution pipeline: from motivation and formalization of the DANG (Dependency-Aware Noise on Graphs) scenario to the proposed DA-GNN model and empirical evaluation.\n- The use of a variational inference framework to model noise dependencies in node features, structure, and labels is well-motivated and backed by a full derivation.\n- Experiments are extensive, covering both synthetic and real-world datasets, and include comparisons across a wide range of baselines and noise types.\n\n\n**Weaknesses:**\n- The paper has several writing issues that hinder clarity. Some symbols in the equations are not clearly defined—for example, the meanings of $q_\\phi$, $p_\\theta$, $p(\\epsilon)$, $p(Z_Y)$ in Eq.1, as well as the use of Bern(.) in line 210, are not explicitly explained in the main text. Some methodological details are buried in the appendix but are critical to understanding.\n- Insufficient introduction of background and related work. The paper assumes familiarity with graphical causal modeling and variational inference, which might limit accessibility for a broader NeurIPS audience.\n- While the problem formulation is original, the method borrows heavily from existing variational techniques (e.g., VAE, CausalNL), and the architectural components (e.g., GCN-based encoders, MLP decoders) are standard. The generative modeling perspective is not entirely new in GNN literature—what is new is its application to a more realistic noise model, which, while valuable, limits the novelty of the method itself.\n- Motivation, methodological details and experimental phenomena require further explanation (see the Questions section).", "was_revised": true, "final_justification": "The rebuttal addressed my concerns. Based on this, I have decided to raise my rating.", "rebuttal": "We sincerely thank the reviewer for carefully reading our paper and providing thoughtful and constructive feedback. We believe the comments are highly valuable and have significantly helped us improve the quality and clarity of the manuscript.\n\n---\n\n## Response to W1\n\nIn the revised manuscript, we have carefully revised the main text to improve readability and clarity. Specifically:\n- We will provide clear definitions for all probabilistic terms in Eq. (1), directly in the main text.\n- We will explicitly explain the use of Bern(⋅) to in main text.\n- Several important methodological details that were previously located in the appendix will be moved into the main text to ensure the paper is more self-contained and easier to follow.\n\nWe believe these revisions significantly improve the clarity and accessibility of the paper, and we thank the reviewer for raising this important point.\n\n---\n\n## Response to W2\n\nWe agree that the original submission assumed a certain level of familiarity with graphical causal modeling and variational inference. In the revised manuscript, we have added the background sections in Appendix to provide a more accessible overview of the necessary concepts.\n\n---\n\n## Response to W3\n\nWhile the implementation of DAGNN draws inspiration from the spirit of VAE  and CausalNL [1], we address complex and unique challenges absent in them. Specifically, the incorporation of $A$ necessitates handling supplementary latent variables and causal relationships, such as $Z_A$, $\\epsilon_A$, $A$ ← $\\epsilon_A$, $A$ ← $X$, $Y$ ← $A$, $A$ ← $Z_A$, each posing non-trivial obstacles beyond their straightforward extension to the graph domain. It's worth noting that we have addressed this issue in Appendix D to underscore the technical advancements of DA-GNN in comparison to [1].\n\n\n[1] Instance-dependent Label-noise Learning under a Structural Causal Model\n\n\n---\n\n## Response to Q1\n\nWe conduct a statistical analysis on a real-world news network, PolitiFact [1], where node features represent news content, node labels correspond to news topics or categories, and edges denote co-tweet relationships—that is, instances where the same user tweeted both pieces of news. The network includes both fake and benign news, with fake news regarded as feature noise induced by malicious user intent ($\\epsilon_X$).\n\nTo investigate noise dependency patterns associated with the presence of fake news, We hypothesize that the presence of fake news (i.e., feature noise) leads to noisy graph structures and noisy node labels in news networks. Specifically, we assign a semantic topic to each news article as a node label using k-means clustering over BERT embeddings of the article content. For each node in the graph, we compute the Shannon entropy of the semantic topic distribution among its neighboring nodes. We then compare these entropy values between fake and benign news nodes (results shown below).\n\n**Fake news**\n- mean: 1.330333\n- 25%: 1.401647\n- 50%: 1.465137\n- 75%: 1.494437\n\n**Benign news**\n- mean: 1.083667\n- 25%: 1.004271\n- 50%: 1.352713\n- 75%: 1.431281\n\n**Mann-Whitney U test**\n- p-value = 4.186423672941698e-25\n- Mann-Whitney U statistic = 47085.5\n\nDescriptive statistics reveal that fake news nodes generally exhibit higher entropy than benign news nodes, suggesting that benign news tends to connect to semantically similar articles (homophilic), whereas fake news is more frequently connected to semantically dissimilar articles (heterophilic). This observation aligns with common user behavior: people typically share news related to their interests, whereas fake news is often propagated indiscriminately, regardless of topical relevance [2]. Furthermore, a non-parametric statistical test (Mann–Whitney U test) confirms that the difference in entropy values between fake and benign news is statistically significant. These findings suggest that the presence of fake news (i.e., node feature noise) introduces noisy and heterophilic edges into the graph structure. Furthermore, model-based automated news topic prediction often performs poorly due to noise in both features and graph structures, ultimately resulting in incorrect label annotations.\n\nIn summary, **these findings empirically support the noisy dependency scenario in real-world scenario where feature noise (i.e., fake news content) can propagate through the graph, generating noisy edges and noisy labels.** This highlights the need for our work that explicitly model and mitigate such noise dependencies in real-world networks. \n\n\n[1] DECOR: Degree-Corrected Social Graph Refinement for Fake News Detection, KDD 2023\n\n[2] Revisiting Fake News Detection: Towards Temporality-aware Evaluation by Leveraging Engagement Earliness, WSDM 2025\n\n---\n\n## Response to Q2\n\nIn response to the reviewer’s comment, we conduct an experiment where we independently double each of the following: (1) the number of fraudsters (i.e., nodes with noisy features) and (2) the activeness of fraudsters (i.e., the amount of structure noise they introduce) in our real-world DANG generation process.\nAs a result, label noise also increases accordingly, in proportion to the amount of generated feature and structure noise.\n\nAs shown in the table below, DA-GNN demonstrates competitive performance and, in many cases, outperforms other baselines under these intensified noise conditions.\n\n|        |        |   AirGNN   |    RSGNN   |   STABLE   |   EvenNet  |    NRGNN   |    RTGNN   |   DA-GNN   |\n|--------|--------|:----------:|:----------:|:----------:|:----------:|:----------:|:----------:|:----------:|\n|  Auto  | DANG w/ doubled # frauds | 54.6±1.5 | 53.4±0.7 | 55.4±0.1 | 56.5±0.6 | 55.9±1.5 | 54.3±2.7 | **60.1±0.7** |\n|        | DANG w/ doubled structure noise | 56.9±0.7 | 50.9±0.6 | **58.1±2.0** | 53.6±2.2 | 55.8±1.3 | 56.78±0.8 | 55.6±1.0 |\n| Garden | DANG w/ doubled # fraudsters  | 57.1±1.3 | 65.0±0.5 | 69.8±2.3 | 69.3±1.8 | 70.8±0.7 | 70.6±0.9 | **71.9±0.6** |\n|        | DANG w/ doubled structure noise | 69.9±2.8 | 69.4±1.3 | 72.0±0.5 | 72.4±0.9 | 71.0±2.4 | **75.3±0.4** | 74.4±0.2 |\n\n---\n\n## Response to Q3\n\nWe conducted sensitivity analyses on our tuned hyperparameters, $\\gamma$, $k$, $\\theta$, $\\lambda_1$, and $\\lambda_2$ in Section 5.4 and Appendix F.6. And we found that **DA-GNN is generally not sensitive to most of them**. Hence, we suggest that DA-GNN is practical and easy to deploy, as it does not require extensive hyperparameter tuning, even in low-resource settings.\n\n---\n\n## Response to Q4\n\nWe apologize for the oversight. We will revise Figure 3 by enlarging the font size and adjusting the layout to improve readability. We also appreciate your observation regarding the missing arrow in Figure 3; we will correct this in the updated version.\n\n---\n\n## Response to Q5\n\nIn response to the reviewer’s concern, we conduct analysis substituting GNN components with GAT. In the below table, we can see that DA-GAT (DA-GNN with GAT) still outperforms other baselines, which demonstrates there is no sensitivity on specific choice of backbone GNNs.\n\n|          |           |  AirGNN  |   RSGNN  |  STABLE  |  EvenNet |   NRGNN  |   RTGNN  |  SG-GSR  |    DA-GCN    |    DA-GAT    |\n|----------|-----------|:--------:|:--------:|:--------:|:--------:|:--------:|:--------:|:--------:|:------------:|:------------:|\n|   Cora   |   Clean   | 85.0±0.2 | 86.2±0.5 | 86.1±0.2 | 86.2±0.0 | 86.2±0.2 | 86.1±0.2 | 85.7±0.1 |   86.2±0.7   | **86.4±0.2** |\n|          | DANG-10\\% | 79.7±0.5 | 81.9±0.3 | 82.2±0.7 | 80.7±0.7 | 81.0±0.5 | 81.6±0.5 | 82.7±0.1 |   82.9±0.6   | **83.0±0.2** |\n|          | DANG-30\\% | 71.5±0.8 | 71.9±0.5 | 74.3±0.3 | 65.2±1.7 | 73.5±0.8 | 72.1±0.6 | 76.1±0.2 | **78.2±0.3** |   76.4±0.6   |\n|          | DANG-50\\% | 56.2±0.8 | 58.1±0.2 | 62.8±2.4 | 47.1±1.8 | 61.9±1.4 | 60.8±0.4 | 64.3±0.5 | **69.7±0.6** |   69.2±0.3   |\n| Citeseer |   Clean   | 71.5±0.2 | 75.8±0.4 | 74.6±0.6 | 76.4±0.5 | 75.0±1.3 | 76.1±0.4 | 75.3±0.3 | **77.3±0.6** |   76.1±0.2   |\n|          | DANG-10\\% | 66.2±0.7 | 73.3±0.5 | 71.5±0.3 | 71.1±0.4 | 71.9±0.3 | 73.2±0.2 | 74.2±0.5 | **74.3±0.9** |   73.4±1.2   |\n|          | DANG-30\\% | 58.0±0.4 | 63.9±0.5 | 62.5±1.4 | 61.2±0.6 | 62.5±0.7 | 63.5±2.1 | 65.6±1.0 |   65.6±0.6   | **67.5±1.2** |\n|          | DANG-50\\% | 50.0±0.6 | 55.3±0.4 | 54.7±1.7 | 47.2±1.1 | 52.6±0.9 | 54.2±1.8 | 54.8±1.8 | **59.0±1.8** |   57.2±0.5   |\n\n\nFurthermore, we compare our method with representative noise-robust GNN approaches on two heterophilic datasets, Cornell and Wisconsin. As shown in the table below, our proposed method, DA-GNN, achieves superior or competitive performance relative to the baselines, demonstrating its broad applicability across diverse settings.\n\n|         | Cornell    | Wisconsin  |\n|---------|------------|------------|\n| AirGNN  | 52.3±5.6 | 61.4±3.3 |\n| RSGNN   | 71.2±3.4 | **77.8±0.9** |\n| STABLE  | 67.6±0.0 | 75.2±1.1 |\n| NRGNN   | 64.0±1.3 | 72.6±4.8 |\n| RTGNN   | 64.4±5.4 | 64.7±0.0 |\n| SG-GSR  | 45.1±5.6 | 59.5±0.9 |\n| DA-GNN  | **72.1±1.3** | 75.2±1.8 |\n\n---\n\n## Response to Q6\n\nIn response to the reviewer’s comment, we conduct a new analysis in which we significantly increase or decrease the influence of noise dependency. Due to length constraints, we kindly refer the reviewer to our response to Reviewer KCjc’s comment W2 for further details."}]

Author rebuttal:

Meta-review: This paper proposes a realistic noise model (DANG) and a corresponding method (DA-GNN) that uses variational inference to capture noise dependencies in features, structure, and labels. The reviewers agree that the problem is important, the method is technically sound, and the experiments are thorough. Concerns about clarity, novelty, and adaptive attack evaluation were raised, but the authors responded with new analyses, empirical evidence, and planned revisions. After the rebuttal, all reviewers were satisfied, with two clear accepts and two borderline accepts raised to support acceptance.
Decision: Accept (poster)