EdgeMask-DG*: Learning Domain-Invariant Graph Structures via Adversarial Edge Masking
Authors: Rishabh Bhattacharya
Naresh Manwani
Venue: Accepted by TMLR ()

Abstract: Structural shifts pose a significant challenge for graph neural networks, as graph topology acts as a covariate that can vary across domains. Existing domain generalization methods rely on fixed structural augmentations or training on globally perturbed graphs, mechanisms that do not pinpoint which specific edges encode domain-invariant information. We argue that domain-invariant structural information is not rigidly tied to a single topology but resides in the consensus across multiple graph structures derived from topology and feature similarity. To capture this, we first propose EdgeMask-DG, a novel min-max algorithm where an edge masker learns to find worst-case continuous masks subject to a sparsity constraint, compelling a task GNN to perform effectively under these adversarial structural perturbations. Building upon this, we introduce EdgeMask-DG*, an extension that applies this adversarial masking principle to an enriched graph. This enriched graph combines the original topology with feature-derived edges, allowing the model to discover invariances even when the original topology is noisy or domain-specific. At equilibrium, the structural patterns that the task GNN relies upon are, by design, robust and generalizable. EdgeMask-DG* is the first to systematically combine adaptive adversarial topology search with feature-enriched graphs. We provide a formal justification for our approach from a robust optimization perspective. We demonstrate that EdgeMask-DG* achieves new state-of-the-art performance on diverse graph domain generalization benchmarks, including citation networks, social networks, and temporal graphs. Notably, on the Cora OOD benchmark, EdgeMask-DG\* lifts the worst-case domain accuracy to {78.0\%}, a {+3.8 pp} improvement over the prior state of the art (74.2\%). The source code for our experiments can be found here: \url{https://anonymous.4open.science/r/TMLR-EAEF/}

Published in Transactions on Machine Learning Research (03/2026)
EdgeMask-DG* Learning Domain-Invariant Graph Struc- tures via Adversarial Edge Masking
Rishabh Bhattacharya
rishabh. bhehhhatccchhroooeeeeeeerr... ac.
Machine Learning Lab & IITTH Hyderabad, India
Naresh Manwani Machine Learning Lab IITTH Hyderabad, India
maresh. waresh..mannmmnniiiii.....
Reviewed OpenReview: https: opeenrve//peervveee. net/ forum? id= Ed=ukfe8Ke76
Abstract
Structural shifts pose significant challenge for graph neural networks, as graph topology acts covariate that can vary across domains. Existing domain generalization methods rely training on globally perturbed graphs, mechanisms that do not pinpoint which specific edges encode domain-invariant information. We argue that domain-invariant structural information not rigidly tied to a single topology but resides in the consensus across multiple graph structures cerived from topology and feature similarity, To capture this, we first propose EdgeMask-DG; a novel min-max algorithm where an edge masker learns find worst-case continuous masks subject to sparsity constraint, compelling task GNN to perform effectively under these adversarial structural perturbations. Building upon this, introduce EdgeMask-DG*, an extension that applies this adversarial masking principle to enriched graph. This enriched graph combines the original lopology with feature-derived edges, allowing the model to discover invariances even when the original topology is noisy or domain-specific. EdgeMask-DG* the first to systematically combinc adaplive adversarial topology search with feature-enriched graphs. We provide a formal justification for our approach from robust optimization perspective. We demonstrate that EdgeMask-DGG* achieves strong overall performance on diverse graph domain generalization benchmarks, including citation networks, social networks, and temporal graphs, with the best average results on the citation benchmark and competitive performance several additional settings. Notably, on the Cora OOD benchmark, EdgeMask- lifts the worst-case domain accuracy to 78.0%, a +3.8 pp improvement over the prior state of the art (74.2%). The source code for our experiments can be found here: httpp:///gtt com.bppark///SSt//////...
fixed structural augmentations
1
Introduction
Graph Neural Networks (GNNs) Kiipf & Welling
2017 Veličković et al. 2018 Hamilton et al. 2017 Xu et al,
2019) have revolutionized learning on graph data, driving progress fields ranging from social network analysis and bioinformatics to recommendation systems (Wu al. 2021). However, their remarkable performance often relies the stringent assumption that training and lesting data are drawn from the same distribution (I..D.).. In many real-world applications, this assumption is violated; data often originates from heterogeneous sources or evolves, leading to distribution shifts that can severely degrade GNN performance (Shi et al. 2024 Zhu et al. 2021a). Graph Domain Generalization (Graph-DG) aims to tackle this fundamental problem by developing models capable of generalizing from one or more source graph domains to unseen target domains with different underlying distributions.
A particularly challenging yet common scenario in Graph-DG involves structural distribution shifts (Chen
et al. 2025 Wu et. al. 2022). In tasks like cross-graph node classification (e-g., predicting research areas

---

Published in Transactions on Machine Learning Research (03/2026)
of papers across different citation networks), the node features and label semantics often remain consistent, while the graph topology can vary drastically. GNNs trained naively via Empirical Risk Minimization (ERM) on source graphs overfit to these domain-specific topological patterns, failing to generalize to target graphs with different structures.
Existing approaches for Graph-DG include designing invariant architectures (Li et al. 2022 employing robust.
training objectives (Wu et al. 2022), or utilizing data augmentation (Chen al.) 2025). Data augmentation methods targeting structural shifts, such GraphAug (Chen et al., 2025), often apply fixed heuristic rules
(e.g., edge dropping based on node degrees, edge addition based feature similarity). These static strategies may not optimally identify the domain-invariant structural factors, which can be complex and data-dependent.
To address these limitations, we first introduce the core algorithmic concept of EdgeMask-DG, & novel min-max adversarial framework. In EdgeMask- DG, an "edge masker" network learns to generate sparse binary or continuous masks over the edges of a given graph. This masker is trained adversarially against a "task GNN" to find masks that maximally disrupt the task GNN's performance, subject to sparsity constraint on the mask. The task GNN, in turn, must learn to perform its task robustly under these worst-case structural perturbations. This process encourages the task GNN to rely structural patterns that are inherently resilient to such adversarial masking.
However, relying solely on the original graph topology, even with adaptive masking, can be problematic if the source topology is sparse, noisy, or highly domain-specific. To overcome this, we propose an extension, EdgeMask-DG*. which applies the EdgeMask-DG adversarial masking principle to an enriched graph representation. This enriched graph is constructed by augmenting the original edges with new edges derived from node feature similarity, specifically using k-Nearest Neighbours (kNN) and spectral clustoring. This allows EdgeMask-DDG* to leverage the (often assumed) invariance of the feature distribution (P(X)) to discover robust structures that might not be apparent in the original topology alone. The adversarial game then proceeds on this enriched graph: the MaskNet identifies challenging sparse masks over both original and feature-derived edges, and the TaskNet (implemented using a Graph Attention Network, GAT (Veličkovid et al. 2018)) learns to perform under these conditions.
A GAT backbone is well-suited for this task, as its layers can directly incorporate the learned edge masks edge attributes, directly inftuencing message passing and attention. This dynamic, learned masking enriched graph allows FdgeMask--DG* to adaptively identify and exploit the most reliable structural information for generalization.
Our contributions are:
We propose EdgeMask-DG, novel min-max adversarial learning framework for Graph-DG that learns domain-invariant edge masks adaptively on given graph structure.
We introduce EdgeMask-DG** an extension that applies this adversarial masking principle to an enriched graph structure, integrating original topology with feature-derived edges (kNN and spectral clustering) to leverage feature invariance and overcome limitations of the original topology.
We employ GAT backbone that naturally incorporates the learned continuous edge masks attributes, enhancing the model's ability to focus relevant substructures.
We demonstrate through extensive experiments that EdgeMask- attains the best average per- formance on the citation Graph-DG benchmark and strong, competitive results across additional datasets spanning citation, social, and temporal graphs.
2 Related Work
Graph Domain Generalization (Graph-DG). Generalizing GNNs to
data is a
critical challenge (Shi et al., 2024 Zhu et al.) 2021a). Early work adapted principles like invariant risk
minimization (Arjovsky et al. 2019 and distributionally robust optimization (e.g., EERM (Wu al.) (0022).
Other strategies include disentangling representations (Zhu al. 2021b: Yu et al. 2023
filtering spurious
2

---

Published in Transactions on Machine Learning Research (03/2026)
correlations via information- objectives (Yang et al. 2023). and unsupervised contrastive learning 2024). On the data augmentation front, methods range from static perturbations like Graph Aug (Zhu et al.
[Chen et al. 2025) to more advanced techniques like generating continuous invariant subgraphs (GRM (Wang ctt al. 2025 or combining adversarial learning with mixup (TRACI (Zao et al. 2025)). Our method differs by using advesaaial edge masking lo adaptively learn domain-invarianl substructures rather than relying on predefined heuristics or variational objectives.
Graph Data Augmentation (GDA). GDA techniques aim to improve GNN robustness and generalization, often in standard graph learning settings (You et al.
2020 Zhu et al. 2021b). Common strategies involve
node dropping, edge perturbation (random or heuristic addition/delece /dllctoo), feature masking, and subgraph sampling You et al. 2020).. GraphAug (Chen et al.
2025) specifically targets Graph-DG structural shifts with predefined rules for edge dropping (low-weight) and edge adding (spectral clustering); however, its heuristics are static. Other works explore learnable GDA (Zhao et al.] 2021), but typically optimize for source domain performance, which may not guarantoe OOD generalization. EdgeMask-DGG uses an adversarial objective to learn domain-invariant structural masks over an enriched graph space.
Adversarial Learning on Graphs. Adversarial techniques are prevalent in graph learning, primarily for enhancing robustness against adversarial attacks designed to fool GNNs (Zügner et al. 2018 Dai et al. 2018). Adversarial domain adaptation (ADA) methods (Wu et al. 2020 Ma et al. 2019 use domain discriminators to align representations across domains, but typically require access to target domain data (labeled or unlabeled) during training, violating the DG setup. EdgeMask-DG* employs a distinct adversarial mechanism: the adversary (MaskNet) operates solely on source domains, perturbing the structure via learned masks to enforce generalizable robustness in the primary model (TaskNet), rather than defending against attacks or adapting to specific target.
Graph Attention Networks (GAT). GAT (Veličković et al. 2018) introduced an attention mechanism allowing nodes to weigh the importance of their neighbours during message passing. Its ability to handle weighted graphs or incorporate edge features makes it well-suited for EdgeMask-DG" where the learned mask values s act as dynamic edge attributes guiding the aggregation process. This contrasts with GCN (Kipl & Welling 2017) or GIN (Xu al.) 2019)., which typically treat edges uniformly or require modifications handle edge weights effectively.
3 Preliminaries
Notation. We represent graph G = = EV,E,X), where V is the set of N V nodes, E is the set of odges, and X E Nxd is the node feature matrix with dimension d. The graph topology can be represented by an adjacency matrix A E {0, 1| Node labels are denoted by Y. A GNN model is denoted by ʃ((), parameterized by 0. The classification loss (e.g., cross-entropy) is Lele.
Graph Domain Gencralization (Graph-DG). We are given M source domains (9's (1 each associatod with a distribution P3(X, A). The goal to learn a model f using data from these source domains, (9', Y's 1 that generalizes well to unseen target domain Gr drawn from Pr Y A), where Pr. + Ps, Vi E {1, (,...., M). Specifically, for cross-graph node classification with structural shifts (Chen et al. 2025 Wu et al. 2022), we make the following assumptions: the marginal distribution of node features is invariant across domains, i.e., Ps: (X) = Pss (X) = -P(X) for any source domains S S); the conditional distribution of labels given features is invariant, ie., Ps: X) = Pss ( = P(Y X) for any source domains St, S"; and the distribution of the graph structure (adjacency A) depends on the source domain, i.e., P(A SS) can change depending on the source domain St. The objective in cross-domain generalization is minimize the target risk: miny FEXT.YT.AA (Latt (f Ar), Y.)).
Graph Attention Networks (GAT). GAT (Veličković et al. 2018 learns node embeddings by atlending over neighbours. For head A at layer I,
(1+1.)
Σ
(L.)) w(LL)) ai
(EN(()
3

---

Published in Transactions on Machine Learning Research (03/2026)
KNN Clusering
Taskkne
Original Training Graph
Full Enriched Graph
Spectral
Clusterig
Figure 1: Dd (1) enrich the graph with kNN & spectral edges; (2) play a min-max max game where MaskNet sparsifies edges and TaskNet (GAT) learns to stay accurate.
where Ozj are softmax-normalized attention scores. Outputs from K heads are concatenated. Our model extends GAT by concatenating the learned mask value Sty to the key-query pair, letting low-scoring edges be down-weighted aulomatically.
Spectral Clustering. Spectral clustering (Von Luxburg 2007 groups data points using the eigenvectors (spectrum) of a Laplacian matrix derived from a similarity graph. For nodes with features X, an affinity mairix is built (e.g., using RBF kernel Sij exp(-|[x; xy x111//2(²)
cosine similarity). The graph Laplacian (c.g., Lagm = D SD 1/2) is computed. The cigenvectors corresponding to the K smallest eigenvalues are used to form a K-dimensional embedding, which is then clustered. This effectively identifies clusters of nodes that are close the feature space, providing a basis for feature-derived edges.
k-Nearest Neighbour (kNN) Graph Construction. Given set of node features X, a kNN graph is constructed by creating edge between node and its most similar peers. For each node i, identify the set of its l nearest neighbors, Ni)1), based a distance metric (e.g., Euclidean distance) metric (c.g., cosine similarity) in the feature space Rd. An edge (i,j) is added to the graph if j E (t).).. This method generates sparse graph structure capturing the most salient local similarities.
similarity
4 Proposed Approach for Cross-Domani Generalization: EdgeMask-DG*
Edg aims to learn a GNN f that generalizes across domains with structural shifts by identifying and utilizing domain-invariant substructures. It achieves this through an adversarial learning process operating on an enriched graph structure, using GAT as the backbone. Figure [ illustrates the two main stages of the EdgeMask- framework: (1) Graph Enrichment augments the source graph topology with featuro-derivod edges from k-Nearest. Neighbors and spectral clustering to form enriched graph; (2) Adversarial Masking a min-max game where MaskNet generates sparse continuous edge mask to identify challenging perturbations while TaskNet (a GAT) learns to minimize classification loss on the masked graph.
4.1 Enriched Graph Representation
Traditional GNNs rely solely the provided graph structure Eg. However, in Graph-DG with structural shifts, Eg can contain domain-specific spurious correlations or be insufficient to capture invariant relationships, especially if the source topology is sparse or noisy. Conversely, node features Xs are assumeed to be more stable across domains (Wu et al. 2022). Motivated by this and by prior work such as GraphAug (Chen et al., enriches the graph representation by incorporating edges derived from node feature similarity alongside the original topological edges. For each source graph Gs (Vs, Xs),,), we construct a set of feature-based edges using two complementary strategies. Both the spectral edge set Espec and the kNN
2025), EdgeMask-
4

---

Published in Transactions on Machine Learning Research (03/2026)
edge set VNNN are generated independently, with each process using the original node features Xg input. The strategies are:
To overcome the limitations of domain-specific topology, Edge.Mask-De. DG* constructs an enriched graph by augmenting the original edges Es with new edges derived from node feature similarity. We use two complementary strategies. First, we capture global similarity by applying spectral clustering to node features Xs to identify K communities; edges Espec are added between all nodes within the same community. Second, capture local similarity by building a k-Nearest Neighbors graph based on cosine similarity, creating edges NNNN. To manage complexity, precompute these full edge sets and, during training, sample subsets esampled
gsompled which is then esampled and ENNN The final enriched edge set is the union E's = Es U Spee U &NNN SSeec
esampled
used in the adversarial masking process.
The motivation for combining these two distinct feature- based edge generation strategies is to capture complementary aspects of node similarity. Spectral clustcring provides global perspective, ensuring that all nodes within broad semantic community are connected, which facilitates robust. intra-cluster message passing. In contrast, kNN offers a local perspective, creating high-precision connections to a node's most immediate peers. This dual approach creates a more comprehensive and multi-scale structural foundation. The enriched structure I's = (Vs, E,g, Xs) then serves as the input for our adversarial masking process.
4.2 Adversarial Edge Masking
The core of EdgeMask- DG* is a min-max max adversarial framework comprising two jointly optimized networks: a TaskNet (fo) and MaskNet (ma.e). The TaskNet is GAT model, parameterized by 0, that performs node classification. It operates the node features Xs and the enriched graph structure G's, with its message passing modulated by continuous edge mask s. The MaskNet is a lightweight network that generates this edge mask. It consists of feature projection layer Pa : RR + gd and a mask prediction MLP Ja. For each odge (u, v) E E/g, it computes a score Suv E [0, 1] basod on the projected features of the incident nodes:
= (e..( z, = (x.,U( Sur = sigmaidd (go ([z. zn,1))
(1)
where [ denotes concatenation, Ps is a two-layer MLP, and asigmoid ensures the output lies in [o, 1]. The two networks are trained via alternating optimization procedure to solve a min-max objective over the source domains Ds. In the first step, the TaskNet's parameters O are updated to minimize the classification loss, conditioned on the adversarial mask s generated by fixed MaskNet. This corresponds to the descent. step of the game:
min P(Gs.Ys)DD, (Ces (Jo(ss G's.), Ys) 0
(2)
During this step, the mask s m (Xs, E's is detached from its generator and treated as fixed edge attribute. Conversely, the MaskNet's parameters (Ø, 1) are updated to find mask that maximizes the TaskNet's loss (with fixed f), while being regularized to enforce sparsity. This ascent step is formulated as an equivalent minimization problem:
min A.v
(ee. L-Lots Ys) + X mean(ma..()))
(3)
where the arguments to the loss and mask functions are as in Eq. 2 mean(mo.v(...)) [E6T E(u.)EES Sues and À is a hyperparameter controlling the sparsity strength. The TaskNet parameters 0 are frozen during this update. This objective encourages the MaskNet to identify edges whose removal or weig-wegghting most siguificantly degrades the TaskNet's performance, while the À term prevents it from applying a dense, uninformative mask.
4.3 GAT Backbone with Edge Attributes
We assume the enriched graph G' = (V, s),, where s sw E [0,1] (u, v) E E'} is the continuous mask produced by the MaskNet. At layer 1, each node u V has a feature vector h!!) Rdo, We employ an H-head Graph Attention Network (GAT) in which, for head k {I,..., H). one first computes the linearly
5

---

Published in Transactions on Machine Learning Research (03/2026)
transformed features zu then given by
(k) W(k (1)
E IRdh. For each neighbor v E NN(,, the unnormalized atlention logit is (
a = LeakyReLLU a (8) (2 [|
( 8uml)
where ((A) E Rd xdw is learnable weight matrix for feature transformation, distinct from the learnable scalar weight (k)) E IR which scales the mask value. The parameters also include the attention vector a (k) E 122 and || denotes vector concalenation. The scalar term w/()) Sue injects the learned mask inlo the attention computation, so that edges with low Sue are less likely to receive high attention weights. We
exp (e())
normalize these logits via softmax over E (u)) to obtain and
EwEN(H) exp 650e
(k) Next, the message passed from v to u under head multiplied by Sues yielding mas = Suo Oau Zr In this way, even if (k) is large, a near-zero Sue will completely mullify the contribution of node v. Node u's aggregated pro-activation representation for head k is then h EveN(w) mue-
(8) At intermediate layers,
we apply a noulinearity o() (RELU) and concatenate across heads: (1+1) = -1 oha E R da, In the =E ) ((h E Rdh, and the final layer, we instcad average across heads before classification: h #
logits are o2 W out h with Wont E RCx,,, When Sue for every edge, this reduces exactly to the standard GAT formulation. When Suv 0, edge (u, is entirely suppressed, both in the attention score (since (k) 8ue 0) and in the message itself. As a result, the adversarially learned mask influences the flow of information during message passing: edges that the MaskNet deems uninformative (low Sav) contribute almost nothing to the final node embeddings. This enables the TaskNet to focus on substructures that are robust across domains.
4.4 Training Procedure
The overall training process is summarized in Algorithm [ It is crucial to nole that the expectations in the objective functions (Eq. and are taken over the source domain distribution Ds. This fundamental constraint of the domain generalization sctting, where the target domain is entirely unseen during training. The algorithm, therefore, optimizes the model exclusively on the source graphs. Intuitively, edges that are highly useful only within particular source graph but not consistently across source domains act source-specifie shortcuts; adversarial pruning suppresses these unstable edges and forces the TaskNet to rely on relations that remain predictive across multiple sources. Because this selection criterion is based solely on cross-source stability under the Graph-DG assumption that P(X) and P(Y X) are stable while P(A 5)) varios, it docs not require any information from the unseen target domain.
The procedure involves iterating through epochs, and within each epoch, processing each source domain. For each source graph, we first construct the enriched edge set &gg. Then, we perform alternating optimization: Ndescent gradient descent steps are taken the TaskNet parameters 0 (minimizing Eq. 2], followed by
Nascent gradient steps on the MaskNet parameters o, vi (minimizing Eq. 3 This adversarial interplay drives the TaskNet to learn representations that are invariant to the structural perturbations found by the MaskNet, thereby promoting domain generalization.
4.5 Theoretical Grounding: Robust Optimization Perspective
The adversarial training procedure of EdgeMask-DG** can be understood through the lens of robust optimiza- tion (Ben-Tal el al. 2009 Bertsimas et al.] 2011). The MaskNet aims to find a "worst-case" sparse mask s within a budget p (defined by m S p) that maximizes the TaskNet's loss ((fe.s) = (xx, Y).
We define this worst-case sparsc-mask loss for a fixed as:
P(0) = max (fo,s), s), where S, = {s E 10, sES,
||s// S sp)
(4)
m
Robust-optimizztionn view. The problem P(0) in equation 4 upper- by the Lagrangian saaaanniann-enaalzeed
objective (0) max [([Jo: s) X |s||] p)] for every X > 0 (weak duality). We therefore train
6

---

Published in Transactions on Machine Learning Research (03/2026)
Algorithm 1 EdgeMask-DG" training procedure
1: Input:
Source graphs {(S' Y' TaskNet fo (GAT), MaskNet ma (Projection Pv, MLP gø); epochs E, learning rates 1j; noo, steps Ndescent, Nascent, sparsity X, kNN sample ratio Vknn spectral sample ratio Tspee-
Initialize parameters 0, 0.
Precompute kNN edges {EANN] D and spectral edges (ESpectral / for all source graphs.
4: Initialize optimizers Opto, Opt
5: for epoch = to E do
6:
for each source graph i E {I...., do
7:
Let 95 = g'g = (Vs, Es; Xs), ys=Y; Y's. Sample esampled S ENNN with ratio Yenn: and sample Spectral C E Spectral with ratio Yspec- Combine edges Egg = coalesce(Es U &NNN U esampted)
esampted
8:
9:
10:
// - TaskNet Descent
11:
for to Ndescent do Compute mask mb. (Xg, Compute logits O = fo (Xs, gg Compute loss Ltask Lats Ys)
12:
1/ Detach from d, tb
// Pass s as edge attr
13:
14:
15:
Update 0 using VoLiask via Oplg.
16:
end for
17:
// MaskNet Ascent
18:
for == 1 to Nascent do
19:
Compute mask m E's Compute logits O (Xg, E) Compute loss Lrask Las Ys)
20:
// Detach O from 0
21:
22:
Compute regularizer R(s) mean(s)
23:
Compute objective Lmask = - Lrask + AR(s) Update s, va using Locck via Opløv.
24:
25:
end for
26:
end for
27:
end for
28: Output: Trained TaskNet So-
0, 3) to find a saddle point for Dxnn (f) with a penalty weight Aage- The MaskNet's objective in Algorithm (maximizing {)e.s) - >alg mean(s)) targets the inner maximization maxg[e(fe.s) Aaig 1 [|s|]]] (ignoring the -AulgP term which is constant w.r.t s for fixed Auig). We show in Appendix D that, when the inner maximisation has converged, the resulting masks satisfy the KKT conditions of the constrained problem. In practice, rather than keeping Aal fixed, one could also update it using dual ascent step like xalg + Pdal + + I|s|| - p)]+, yielding a primal-dual algorithm that can help drive the mcan mask value toward p. For simplicity in this work, we keep Aalg as a fixed hyperparameter.
Furthermore, we can characterize the properties of the optimal adversarial mask s* sought by the MaskNet using the Karush-Kuhn-Tl Tucker (KKT) conditions associated with equation 4 The continuous mask values Suv <[0, 1] generated by our MaskNet (Eq. 1] are differentiable. If employing discrete masks, techniques like Gumbel-softmax (Jang et al.) 2016 Maddison et al., 2016) or hard-conerete distributions can provide differentiable relaxations, making the following analysis applicable to such cases.
Lemma 4.1 (Optimality Conditions for Adversarial Mask). Let s* be optimal solution to the mask optimization problem equation A for fized 0. Assuming continuous differentiability of {(fe,s) w.r.t. and constraint qualifications (Slater's 's condition holds), there erists an oplimal dual variahle Xj, 2 0 (corresponding to the sporsity constraint) such that the optimal mask volues st satisfy the following conditions for all
St(
Xi.
edges e. (a) I < st <1 (edge partially masked):
(b) If 8t = (edge fully masked):
ase
m
aE(Jo.s)) Ōsc
N
a aE(So.8)
Xi
<
(c) If - (edge fully included):
z
m
Osc
m
7

---

Published in Transactions on Machine Learning Research (03/2026)
Interpretation: Lemma 4.1 reveals that the optimal adversarial mask operates based threshold mechanism determined by the optimal spansity cost -" = X Edges whose marginal contribution to increasing the loss (0t/Os.) exceeds this threshold are fully included (s = =), edges whose contribution is below the threshold are fully masked (s = 0), and edges whose contribution exactly matches the threshold can be partially masked (0 < s < 1). This provides insight into how the MaskNet prioritizes edges based on their impact on the TaskNet's loss versus the sparsity budget. The alternating training procedure (Algorithm ]
drives the TaskNet become robust against masks with these properties, encouraging reliance on structures whose removal does not drastically increase the loss.
4.6 Computational Complexity
A thorough analysis of the computational complexity for our EdgeMask- DG variants, considering both precomputation and per-epoch training costs, is provided in Appendix B.1 The detailed breakdown incorporates parameters such as the number of nodes (N), edges (M, M), feature dimensions (F, P), GAT architecture (I., H, h), and training schedule (T, D, U, K). After substituting typical hyperparameter values and focusing on dominant terms, the key findings are as follows: The base EdgeMask-DG model (without additional odges) cxhibits an overall complexity of OKTN), primarily driven by the epoch-wise training on sparse graphs. Introducing kNN augmentation in EdgeMask-DGG (kNN only) shifts the bottleneck to the precomputation phase, resulting in an overall complexity of O(K)2). The most comprehensive variant, EdgeMask-DG* (kNN + spectral), which also incorporates spectral clustering edges, sees its complexity further increase to O(KN*), dominated by the spectral precomputation. This progression underscores the trade-off between richer graph representations and computational cost. In particular, the spectral variant. is the least scalable component of our framework and is best suited to moderate-scale settings; extending EdgeMask-DG* to larger graphs will require approximate or sparse enrichment schemes.
Augment-then-prunt rationale. EdgeMask- DG* widens the relational hypothesis space via a union graph of original and feature-guided edges, and then learns a sparse adversarial mask over this union. Importantly, the objective does not encourage indiscriminate removal of edges that are universally useful. Because the TaskNet is trained to maintain low loss under worst-case sparse masking across multiple source domains, edges whose utility is stable and redundant across sources can still be supported by alternative relational paths in the union graph, whereas edges that act as source-specific shortcuts are more likely to be removed. Under the standard Graph-DG assumption that P(X) and P(Y X) are stable while P(A S) varies across domains, this pressure favors relational patterns that remain predictive after sourco-specific edges are suppressed. This argument depends only on source-domain variability and does not require access to the target domain. Empirically, the learned mask prumes both original and augmented edges while retaining 30 39% of augmented edges on average (Table 6 and augmentation helps our method but hurts naive baselines (Table
5 Experiments
We evaluate Fdg+ on a diverse set of benchmarks for node classification under domain shifts, comparing it against various baselines and recent state-of-the-art methods.
5.1 Experimental Setup
Our evaluation spans several benchmark datasets prevalent in Graph-DG research, selected to cover diverse distribution shifts, graph properties, and evaluation schemes. A primary set of experiments focuses the widely used citation networks ACMv9 (A), DBLPv7 (D), and Citationvl (C) these datasets, nodes represent academic papers with bag-of-words words abstract features (6,775 dimensions) and are classified into 5 rescarch arcas. The core challenge arises from significant structural differences across these graphs despite consistent feature and label semantics. To assess broader applicability, we extend our evaluation to additional benchmarks detailed in Table D This set includes Cora and Amazon-Photo (featuring artificial transformations), Twitch- explicit, Elliptic, and OGB-Arxvv (characterized by temporal evolution), and Facebook- 100 (involving cross-domain transfers). These datasets also vary in their train/ wwaii/aaaiiiiioo////oooooooooiia seaiiiioo/tttt,te splitting strategies, utilizing
8

---

Published in Transactions on Machine Learning Research (03/2026)
either domain-level time-aware splits.
For the citation networks (ACM, DBLP, Citation), we employ the
Table 1: Summary of datasets. "Artificial Transformation" uses synthetic spurious features to create domain shifts; (Cross-Domain Transfers" uses graphs from distinct domains; "Temporal Evolution" uses dynamic graphs. Splits are "Domain-Level" (by graph) or "Time-Aware" (by time). See Appendix E for details.
Dataset
#Nodes
# Edges
# Classes
Split
Metric
Artificial Transformation
Cora
2,703
5,278
10
Domain-Level
Accuracy
Ahozon-Photo 7,650
119,081
10
Domain-Tevel
Accuracy
Cross-Domain Transfers
Twitch-cxplicit
1,912-9,498
31 122999953,118
2
Domain-Level
ROC-AUC
Facebook- 100
769 41,536
16,65 16,656 1,590,655
Comain-Levee
Accuracy
Temporal Evolution
Elliptic
203,769
234,355
Time-Aware
F1 Score Accuracy
OGB-Ane Arxiv
169,343
1,166,243
40
Twae-Aware
Adapted from: Yang et al.] (2016) Shehur et al. (2018)
Rozemberczki & Sarkar
2021
Traud
et
(2011): ); Pareja et al. (2020): Hu et al. (2020).
standard leave-one-domain-ont protocol. This involves training a model on two domains (e.g. A and C) and evaluating its performance on the unseen third domain (e.g., D), leading to three distinct scenarios: AC-D, AD-C, and CD-A. Performance quantified using Micro-F1 and Macro-F1 scores (Sechidis et al. 2011] For the additional datasets (Cora, Photo, FB-100, Twitch, Elliptic, ArXiv), we adhere to their established train/ validatiion///ooa / test splits and evaluation metrics such as Accuracy, ROC-AUC, F1 score as specified in Table 1 and common in cxisting literature.
We benchmark BdgeMask-DG' against a comprehensive set of methods. This includes standard GNNs trained with Empirical Risk Minimization (ERM), such as GCN (Kipf & Welling 2017), GIN (Xu et al. 2019 GAT
Veličkovíć et al. 2018), and SGC (Wu et al., 2019). We also compare against general domain domain-generale generalization and robust ness Lechniques, including ERM, DRNN (Sagawa el al.] 2020),, MMD (Li el al.] 2018), ARM
Zhang et al. 2021), and EERM (Wu al.,
2022). Furthermore, our comparison encompasses specialized
Graph-DG methods: EGC Tailor ct al.)
2022 ADA (Volpi et al. 2018). MAT (Wang et al. 2022 FLOOD
Liu et al.
2023). MARIO (Zhu et al. 2024), LiSA (Yu et al., 2023), IS-GIB (Yang al. 2023).
and GRM
Wang et al. 2025 Finally, we include recent state-of-the-art approaches like TRACT (Zhao et al. 2025 and
GraphAug CChen et al.] 2025), which utilize both GCN and GIN backbones.
EdgeMask--DG* is implemented using PyTorch Geometric Fey & Lenssen 2019 The TaskNet (fe) is a 4layer Graph Attention Network (GAT) with 8 attention heads, a hidden dimension of 64 per head, ELU activation, and dropout rates of 0.6 for attention coefficients and 0.5 between layers. The MaskNet (ma.w) comprises projection layer Ps that maps the input node feature dimension d to d' = 128, followed by an MLP 96 with one hidden layer of size 64. Training employs the Adam optimizer (Kingma & Ba 2014). For the citation benchmarks (ACM, DBLP, Citation), we use a lcarning rate of 10-3, TaskNet weight decay of 5 x 10-4, and train for 200 epochs. Key hyperparameters include a sparsity coefficient. X = 10-3 (For citation benchmarks, potentially varied for others), Ndeecent = 5 TaskNet steps, and Nascent = 1 MaskNet step per iteration. The enriched graph structure incorporates kNN edges (with k 10 using cosine similarity) and spectral clustering edges (with K. 100 clusters for citation benchmarks). We sample these feature-derived edges with ratios Tean 0.1 and 7spec 0.1, though these parameters are adjusted for different datasets.
9

---

Published in Transactions on Machine Learning Research (03/2026)
5.2
Main Results
We present the empirical evaluation of EdgeMask-DG's comparing its performance against a comprehensive suite of basclines and statc-of-the-art mothods across various domain generalization benchmarks. The results demonst.rate the effectiveness of our proposed adversarial masking on enriched graph structures.
5.2.1 Performance on Citation Networks (ACM, DBLP, Citation)
Table summarizes the performance on the cross-graph node classification task using the ACM, DBLP, and Citation datasets. This oaae--one-oomiin- evaluation directly tests generalization to unseen graph structures. Overall, EdgeMask-DGr achieves the highest total average F1 score of 73.81, surpassing all other methods, including the recent strong baseline GRM (73.28). This indicates the superior overall generalization capability of our approach. Specifically, our method establishes new state-of-the-art performance in two of the three challenging scenarios. In the AD-C scenario, EdgeMask-DG" achieves Micro-Fl of 79.14% and a Macro-F1 of 77.60 77.66%, outperforming all competitors. The improvement in Macro-F1 is particularly notable, suggesting our model's robustness in classifying less frequent classes. Similarly, in the CD-A scenario, our method leads with a Micro-F1 of 71.62% and a Macro-F1 of 72.11%. In the AC-D scenario, while GRM reports the highest scores, EdgeMask- DD* remains highly competitive with a Micro-F1 of 72.54%, performing on par with or better than other recent methods like GraphAug (GIN) and TRACI. These results validate that our proposed mechanism of discovering invariant substructures through adversarial masking enriched graph is highly effective for handling the structural shifts inherent in citation networks.
Table Performance on cross-graph node classification (ACM, DBLP, Citation). Results are mean F1 scores (% + std. dev.). Best results per column are in bold. EdgeMask-DG" uses a GAT backbone and adversarial masking on enriched graphs (kNN + Spectral edges).
Method
AC-D
AD +C
CD~A
Total Avg
Micro F1
Macro F1
Micro F1
Macro F1
Micro F1
Macro F1
MMD
68.70 = 0.88
65.88 = 0.54
70.24 = 0.77
65.79 + 2.40
62.24 + 1.48
58.45 + 4.15
65.22
ERM
67.92 + 0.50
62.72 = 0.58
70.91 + 0.61
67.81 + 0.69
62.44 + 0.98
59.64 + 2.34
65.24
DRNN
69.07 + 0.90
65.19 = 0.26
71.46 + 0.69
67.98 + 0.86
63.45 + 0.89
60.27 + 4.00
66.24
GA (GCN)
71.45 = 0.55
67.19 0.72
71.62 = 0.75
66.09 + 0.56
66.44 + 0.52
60.70 + 0.70
67.25
EERM
71.31 + 0.10
68.39 + 0.19
72.91 + 0.39
68.47 + 1.32
65.28 + 1.04
62.98 + 2.49
68.22
LISA
70.34 +: 1.45
67.15
73.53 + 0.60
69.65 + 0.88
66.28 + 0.67
64.17 + 2.43
68.52
TRACI
72.95 = 0.77
69.25
74.20 0.68
69.08 + 1.07
67.01 + 1.04
65.03 + 0.35
69.59
MARIO
71.71 0.72
68.66
76.05 0.16
0.20 72.38
67.90 0.47
67.13 0.16
70.64
GA (GIN)
72.55 + 0.60
70.05 1.71
74.77 + 0.60
71.79+1.11
69.43 0.65
68.77 + 1.07
71.23
GRM
73.72 0.75
71.19
0.93
79.13 0.22
75.74 + 0.54
70.23 1.04
69.66 2.00
73.28
EDG*
1.1
69.81 = 1.76
79.14 + 0.19
77.66 0.15
71.62 = 0.29
72.11 + 0.25
73.81
5.2.2
Performance on Diverse Graph-DG Benchmarks
To assess the broader applicability of EdgeMask-DG** we evaluated it on datascts exhibiting different types of distribution shifts, as shown in Table 3 and Table i On benchmarks with artificial domain shifts (Cora and Photo), EdgeMask-DGG demonstrates exceptional performance, achieving the highest minimum and average accuracy. On Photo, the average accuracy of 94.8% represents a more than 2-percent improvement over the next best method, GRM. The model also performs very strongly on the cross-domain social network Twitch, attaining the highest average ROC-AUC of 59.3%, which substantial improvement over prior work.
10

---

Published in Transactions on Machine Learning Research (03/2026)
However, the FB-100 dataset, our method's performance is less competitive. The average accuracy of 52.1% is lower than that of several baselines, and the minimum accuracy of 45.4 is also comparatively low. This outcome suggests that the core assumption of our method that node features provide a stable, domain-invariant signal for constructing a reliable enriched graph-may be less effective for the FB-100 dataset, where the topological structure might be overwhelmingly dominant and the node features less informative for gencralization.
On the temporal benchmarks, Elliptic and ArXiv, the results presented in Table I show varied performance relative to the baselines. While one method, GRM, reports exceptionally high, toate-of-thheart scores, these results are unverifiable due to the lack of a public codebase. Among the verifiable methods, EdgeMask-DG" delivers competitive performance. For instance, on Elliptic, its average F1 score of 69.7% is comparable to methods like ARM (69.9%) and MMD (70.6%), though lower than DRNN (71.8)). A similar trend is observed on ArXiv, where our method competitive with baselines but outperformed by MARIO and IS-GIB. This suggests that while our approach is robust, specialized methods for handling temporal evolution may have advanlage in these specific settings.
Table OOD Performance on Cora, Photo, FB-100 & Twitch. Min. denotes minimum accuracy Caaeraayy/O-AUUUG RROC-AUC across domains/ /runi, Avg. denotes average. Best results in bold. Values for EdgeMask-DGG DG* single-seed for Min. (no +) and include for Avg. where provided.
Method
Cora
Photo
FB-100
Twitch
Min.
Avg.
Min.
Avg.
Min.
Avg.
Min.
Avg.
ERM
65.0 + 1.5
68.2 + 0.4
84.4 + 1.5
88.6 1.3
50.5 0.4
52.8 0.6
49.7 + 1.1
52.2 = 0.9
DRNN
56.4 1.4
74.8 + 1.2
76.7 + 1.5
77.1 1.2
48.0 1.0
0.7
44.0 0.5
48.1 = 1.4
MMD
+ 1.5
75.8 + 0.6
82.1 + 1.1
84.8 + 0.6
51.4 0.9
+.7
42.8
49.1 + 0.9
ARM
6.1
1.1
0.7
1.3
0.9
4.5
48.5 = 1.3
EERM
0.6
1.0
0.5
91.8
0.4
14
5.8
54.1 0.9
LISA
1.5
0.8
9.2
9.5
1.2
14
4..
55.8 - 2.2
IS-GIB
71.3
78.6 1.5
0.6
90.2+
49.6 + 1.6
54.6
51.2
56.0 + 1.2
MARIO
70.8
76.1 1.0
88.6
8.
50.3 1.9
1..9
5..7
55.1 - 1.9
GRM
74.2
81.2 1.5
91.3
9..7
52.0 + 1.3
55.1
52.5 1.7
56.7 + 1.0
EDG*
78.0 = 1.2
83.2 + 1.1
94.3 + 0.6
94.8 + 0.6
45.4 + 1.2
52.1 + 1.8
52.5 + 1.3
59.3 + 1.7
6
Ablation Studies
6.1
Rationale for Augmentation and Pruning
We now provide empirical justification for EdgeMask-DDG*t two-stage design: first enriching the relational space via graph augmentation, then distilling domain- invariatn structures through adversarial pruning.
Augmentation enriches the structural hypothesis space. Table 5 demonstrates that incorporating kNN and spectral edges substantially increases the expressiveness of the graph representation across all benchmarks. Augmentation yields 58.7% increase in edge count for citation networks, accompanied by higher average degree, elevated spectral entropy (indicating greater structural diversity), and reduced feature Laplacian smoothness (reflecting stronger feature-structure coupling). These metrics show that augmentation expands the relational hypothesis space, providing the model with a richer space from which to extract. domain-invariant patterns.
Adversarial masking prunes both sources selectively. The learned mask does not trivially preserve all augmented edges remove all original edges; rather, it performs adaptive filtering across both edge types.
11

---

Published in Transactions on Machine Learning Research (03/2026)
Table 4: OOD Performance on Elliptic & ArXiv. T1 '3 denote different time periods. Avg. denotes average. Best results are in bold. "GRM results are unverifialle because the codebase not publicly available.
Method
Elliptic
ArXiv
T1
T2
T3
Avg.
T1
T2
T3
Avg.
ERM
59.6 1..01.4 1.4
63.5 + 1.3
61.7 + 0.6
61.6
47.6
45.5 1.4
1..
44.8 + 1.4
EERM
0.4
63.8 - 0.6
55.5 0.6
1.1
5.
4.4
4.
47.8 1.4
ARM
1.5
0.77
1.4
1.3
4.7
4.6
0.87
4.0
LISA
0.9
65.6 0.7
1.0
0.8
4.6
4.5
4.8
4.67
MMD
0.7
70.1 0.4
0.8
7.86
4..
4.74
3.0
4..
EDG*
1.2
68.9 + 0.9
1.3
1.0
1.11
0.8
1.2
45.9 1.0
DRNN
+..2
71.4 0.7
70.6 0.3
0.88
4.5
4.17+
4.3
44.0 1.0
IS-GIB
1.1
1.0
1.2
1.1
0.8
0.9
1.3
48.8
MARIO
1.9
72.8 2.4
71.11.4
2.0
48.8 2.3
2.4
49.2
49.4 + 288
GRM
8.1 1.5
89.1 1.5
8..
52.2
5..
56.1
53.6 + 1.2
Table 5: Subspace enrichment after augmentation (5 seeds; mean = std)
E
increase
Avg. degree
Spectral entropy
Feat. Laplacian
Dataset / Split
(%)
smoothness
ACM/DBLP/Citation (avg.)
58.7
2.1 + 0.1
0.26 + 0.02
0.14 0.01
Cora
47.5 + 3.2
1.6 0.1
0.19 + 0.02
0.11 + 0.02
Amazon-Photo
38.4
1.1
0.17 + 0.02
0.09 + 0.02
Twitch (avg.)
41.2
1.2
0.18 0.03
0.10 0.02
Facebook-100 (avg.)
36.9 2.4
1.2
0.15
0.07 0.01
Elliptic (TI T3 avg.)
0.9
0.12
0.06 1 0.01
OGB-Arxiv (T1-T3 avg.)
29.8 + 2.0
0.8
0.10 +
0.05 + 0.01
As shown in Table i the adversarial mechanism prunes approximately 68.3% of augmented edges while simultaneously removing 18.9% original edges, yet. retains 39% of augmented edges on average. From this we can infer that augmented edges contribute non-trivial domain-invariant information that complements, rather than replaces information in the original topology.
Table Mask behavior: fraction of edges pruned/retaing (5 seeds; mean + std).
Dataset
Split
Pruned from Aug (%)
Pruned from Orig (%)
Aug edges retained (%)
Citation avg.
68.3 + 2.1
18.9 + 1.5
31.7 + 2.1
Cora
70.5 + 2.4
16.2 + 1.3
29.5 + 2.4
Amazon-Photo
65.4 + 2.2
21.7 + 1.6
34.6 + 2.2
Twitch (avg.)
66.8 2.7
20.9 + 1.8
33.2 2.7
Facebook-100 avg.
64.2 1 2.5
22.5 + 1.7
35.8 + 2.5
Elliptic avg.
61.3 + 2.0
24.1 + 1.5
38.7 + 2.0
OGB-Arxiv avg.
62.7
23.4 + 1.6
37.3 + 2.1
12

---

Published in Transactions on Machine Learning Research (03/2026)
Combined effect 2 2 study (Table confirms that both augmentation and masking necessary, and their combination is synergistic. Training with masking on the original graph alone (Orig + Mask) provides modest gains over standard EERM. Training on the augmented graph without masking (Union / No-Mask) yields further improvement. However, the full EdgeMask-DGG method (Union + Mask) consistently achieves the highest performance, with improvements ranging from 0.5 to 2.3 percentage points over the nex(-best. variant across all benchmarks.
Table 7: 2 x 2 ablation (5 seeds; mean + sid). 'No-Mask' EERM, 'Mask" = advensarial masking.
Dataset
Metrie
Orig / No-Mask
Orig + Mask
Union / No-Mask
Union + Mask (ours)
AC-+D (Micro-F1 %)
69.5 + 0.7
70.8 + 0.6
71.6 + 0.6
72.54 + 1.41
AD-C (Micro-F1 %)
75.5 - 0.6
77.0 + 0.5
78.6 + 0.4
79.14 + 0.19
CD-+A (Micro-F1 %)
66.8
68.2
70.5 + 0.5
71.62 + 0.29
Cora (Acc %)
0.9
82.1 0.8
82.6 + 0.8
83.2 + 1.1
Amazon-Photo (Acc %)
92.5 0.6
93.7 + 0.5
94.3 0.5
94.8 + 0.6
Twitch (ROC-AUC)
5.2
1.1
58.6 + 1.0
5 1.7
Facebook-100 (Ace %)
50.1 1.2
51.2 1.1
51.8 + 1.1
1.8
Elliptic (F1 %)
67.2+11
68.6 1.0
09.2
69.7 00.7+10 1.0
OGB-Arxin (Ace %)
44.3
4.91
45.6 + 0.9
4
Unique benefit of adversarial filtering. Table g reveals distinction: naive augmentation (training directly the union graph) degrades performance for standard baselines (ERM, EERM, GRM, IS-GIB), with A values ranging from -0.9 to -0.2 across datasets. In contrast, EdgeMask-DDe DG* consistently benefits from augmentation, achieving positive A values of +0.8 to +2.3 percentage points. This demonstrates that the adversarial masking mechanism essential. Without it, the added edges introduce more noise than signal, whereas with it, the model successfully identifies and leverages domain-invariant augmented structures.
Table 8: A from augmentation (Augmented minus Original). Mean + std over 5 seeds.
Dataset / Split
ERM A
EERM A
GRM A
IS-GIB A
Ours
Cora
0.8 + 0.6
-0.6
0.6
0.2
+1.1 + 0.5
Amazon-Photo
-0.5 0.5
0.57
0.5
0.3
+1.1 0.4
Twitch
-0.9 + 0.7
0.6
0.6
0.6
+2.3 0.6
Facebook- 100
-0.7 0.6
0.6
0.
0.3
+.5
Elliptic
-0.4 + 0.5
0.5
0.5
0.2
+.5
OGB-Arxiv
-0.6 + 0.5
0.5
0.3
-.2
+.3
6.1.1 Effect of Sparsity Regularization À
We evaluate EdgeMask-DGG* with varying values of the sparsity coefficient À in Eq. 3 The results for the CD-A scenario (on citation networks) are shown in Table g The results in Table 9 demonstrate that the sparsity regularization term is a key component for effective generalization. While the model performs well without any explicit sparsity penalty (A = 0), introducing a non-zero À consistently improves performance. The model achieves optimal or near-optimal results across a range of small values, particularly between 10-5 and 10-2, indicating robustness to the exact choice of this hyperparametor within this effective range. The explicit sparsity term helps guide the MaskNet to find challenging yet meaningful perturbations, preventing it from simply masking large number of edges.
13

---

Published in Transactions on Machine Learning Research (03/2026)
Table 9: Ablation on the sparsity coefficient (A) for the CD scenario (5 seeds; mean = std). Metrics are F1 scores (%).
Micro-F1 (%)
Macro-F1 (%)
70.60 + 0.35
71.54 + 0.38
le-5
71.78 + 0.28
72.69 + 0.30
1e-4
70.85 + 0.42
71.48 + 0.44
1e-3
71.59 = 0.26
72.18 = 0.29
le-2
71.63 + 0.27
72.65 + 0.31
le-1
71.49 + 0.30
72.18 + 0.33
7 Conclusion
We introduced EdgeMask-DG*, a novel Graph-DG framework that learns domain-invariant substructures to handle structural shifts. It operates via min-max game on an enriched graph, where an adversarial masker challenges a GAT-based classifier by finding worst-case sparse edge masks. This forces the classifier become robust to structural perturbations and rely on generalizable patterns. Our approach, which combines original topology with feature-derived edges, overcomes the limitations static augmentations. Experiments show that EdgeMask-DG* attains the best average results the citation benchmark and strong, competitive performance across several additional settings, while the ablations confirm the value of both the enriched graph and the adversarial mechanism. Future work should focus on more scalable graph-enrichment procedures, especially approximate alternatives to spectral augmentation, and on extensions to graph-level tasks.
Acknowledgements
Naresh Manwani gratefully acknowledges support from ANRF under grant CRG/2023/007991
References
Martin Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Paz Invariant risk minimization. arXie preprint orXi::1907, 02803, 2019.
Aharon Ben-Tal, Laurent El Ghaoui, and Arkadi Nemirovski. Robust Oplimization. Princeton University Press, Princeton, NJ,, 2009. ISBN 978-0-691-13528
Dimitris Bertsimas, David B. Brown, and Constantine Caramanis. Theory and applications of robust optimization. SIAM Review, 53(3)=464-501, 2011. doi: 10.1137/100788221.
Guanzi Chen, Jiying Zhang, and Yang Li. Graph augmentation for cross graph domain generalization. arXiv preprint ar Xix::25002. 18188, 2025.
Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. Adversarial attack graph structured data. In International Conference on Machine Learning (ICML), pp. 1115 1124. PMLR, 2018.
Matthias Fey and Jan Eric Lenssen. Fast graph representation learning with pytorch geometric. In ICLR Workshop Representation Learning Graphs and Manifolds, 2019.
Will Hamilton, Rex Ying, and Jure Leskovec. Inductive representation learning on large graphs. In Advances in Neural Information Processing Systems (NewrIPS), volume 30, 2017.
Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovee. Open graph benchmark: Datasets for machine learning on graphs. CoRR, abs /b000000000687, 2020. URT. htttp::://axxivorr//bbaaa
abs http//0000000000
14

---

Published in Transactions on Machine Learning Research (03/2026)
Eric Jang, Shixiang Gu, and Ben Poole. Categorical reparamcterizatioo with gumbel-softmax. arXiv preprint arXix:661.001 2016. URL http://aaax.i..orra/a///1.....
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. ar preprinl
arXiv:1412. (tt:::1412.688888 2980,,96600...0 2014.
Thomas N Kipf and Max Welling, Semi-supervised classification with graph convolutional networks. In International Conference on Learning Representations (ICLR), 2017.
Haoliang Li, Simno Jialin Pan, Shiqi Wang, and Alex C. Kot. Domain generalization with adversarial feature learning. In Proceedings of the IEEE/CVE Conference Computer Vision and Pattern Recognition (CVPR), pp. 5400-544 5409, 2018.
Haoyang Li, Xin Wang, Ziwei Zhang, and Wenwu Zhu. Out-of-distrribttion generalization on graphs: A survey. aixiv preprint orXiv:200..000 07987, 2022.
Yang Liu, Xiang Ao, Fuli Feng, Yunshan Ma, Kuan Li, Tat-Seng Chua, and Qing He. Flood: A flexible invariant learning framework for out-of-distribution generalization on graphs. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD '23), pp. 1548-1558, Long Beach, CA, USA, 2023. ACM. doi: 10.1 10.1145 155555555555 14144555300053550000 35999955.
Xiaojun Ma, Feiyang Zhao, Zheng Qin, Xuechen Sun, Wenwu Ou, and Yong Xu. Graph convolutional adversarial network for unsupervised domain adaptation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10000 10009, 2019.
Chris Maddison, Andriy Mnih, and Yee Whye Teh. The concrete distribution: A continuous relaxation of discrete random variables. arXiv preprint 1xxx::1611.000 2016. URL httpp::/arrxi..or///eeet
00712
Aldo Pareja, Giacomo Domeniconi, Jie Chen, Tengfei Ma, Toyotaro Suzumura, Hiroki Kanezashi, Tim Kaler, Tao B. Schardl, and Charles E. Leiserson. Evolvegen: Evolving graph convolutional networks for dynamic graphs. In The Thirty-Fourtle AAAI Conference on Artificial Intelligence (AAAI 2020), pp. 5363 5370. AAAI Press, 2020. doi: 10.1609 haa09//aivvvvv v34i04.5984.
URL https://doi. org. 1609/ /aaii v34104..984
Benedek Rozemberczki and Rik Sarkar. Twitch gamers: a dataset for evaluating proximity preserving and structural role- based node embeddings. CoRR, abs/2101.03091, 2021. URL https://arxiv.. ort.:/ssg////////////
2301.
Shiori Sagawa, Pang Wei Koh, Tatsunori B. Hashimoto, and Percy Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generalization. In International Conference on Learning Representations (ICLR), 2020.
Konstantinos Sechidis, Grigorios Tsoumakas, and Ioannis Vlahavas. On the stratification of multi-label data. In European Conference Machine Learning and Knowledge Discovery in Databases (ECML PKDD), volume 6912 of LNCS, pp. 145-158. Springer, 2011. URL htttp:://pph csd. auth. gr /ttpulliicaions///// sechidis-ecmlptee 2011.pdft
Oleksandr Shehur, Maximilian Mumme, Aleksandar Bojchevski, and Stephan Günnemann. Pitfalls of graph neural network evaluation. CoRR, Abs/1811.0555 2018. URL
Boshen Shi, Yongqing Wang, Fangda Guo, Bingbing Xu, Huawei Shen, and Xueqi Cheng. Graph domain adaptation: Challenges, progress and prospects. arxiv preprint (XXi:2402200000 2024.
Shyam A. Tailor, Felix L. Opolka, Pietro Liò, and Nicholas D. Lane. Do need anisotropic graph neural networks? In International Conference on Learning Representations (ICLR), 2022. Introduces Efficient Graph Convolution (EGC) baseline.
Amanda. Trand, Peter J. Mucha, and Mason A. Porter. Social structure of facebook networks. CoRR, abs/1102.21666, 2011. URL htR.tttt://// httt:://aaxxti http:p///aara...rrgaaa//1022222 wttp:////////...////...
15

---

Published in Transactions on Machine Learning Research (03/2026)
Petar Veličkovié, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pictro Liò, and Yoshua Bengio. Graph attention networks. In International Conference on Learning Represenlations (ICLR), 2018.
Riccardo Volpi, Hongseok Namkoong, Ozan Sener, John C Duchi, Vittorio Murino, and Silvio Savarese. Gencralizing to unscen domains via adversarial data augmentation. In Advances in Neural Information Processing Systems (NewrIPS), volume 31, 2018.
Uhrike Von Luxburg. tutorial on spectral clustering. Statistics and computing, 17(4):395-411 2007.
Qixun Wang, Yifei Wang, Hong Zhu, and Yisen Wang. Improving out-of-distributte generalization by adversarial training with structured priors arXiv preprint arXiv:2210.000 06800, 2022.
Song Wang, Zhen Tan, Yaochen Zhu, Chuxu Zhang, and Jundong Li. Generative risk minimization for outto--distiibutiin generalization on graphs. Transactions on Machine Learning Research, 2025. URL TMLR, February 2025.
Felix Wu, Tianyi Zhang, Amauri Souza Jr, Christopher Fifty, Tao Yu, and Kilian Q Weinberger. Simplifying graph convolutional networks. In International conference on machine learning (ICML), pp. 6861-6871. PMLR, 2019.
Man Wu, Shirui Pan, Chuan Zhou, Xiaojun Chang, and Xingquan Zhu. Unsupervised domain adaptive graph convolutional networks. In Proceedings of The Web Conference 2020, pp. 1457-1467, 2020.
Qitian Wu, Hengrui Zhang, Junchi Yan, and David Wipf. Handling distribution shifts on graphs: An invariance perspective. In International Conference Learning Representations (ICLR), 2022.
Zonghan Wu, Shirui Pan, Fengwen Chen, Guodong Long, Chengyi Zhang, and Philip S Yu. A comprehensive survey on graph neural networks. IEEE Transactions Neural Networks and Learning Systems, 32(1): 4 4-24, 2021.
Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. How powerful are graph neural networks? In International Conference on Learning Represenlations (ICLR), 2019.
Ling Yang, Jiayi Zheng, Heyuan Wang, Zhongyi Liu, Zhilin Huang, Shenda Hong, Wentao Zhang, and Bin Cui. Individual and structural graph information bottlenecks for dustor-distti generalization. TKDE, 2023.
Zhilin Yang, William Cohen, and Ruslan Salakhudinov. Revisiting semi-supervised learning with graph embeddings. Maria Florina Balcan and Kilian Q. Weinberger (eds.), Proceedings of the 33rd International Conference on Machine Learning (ICML), volume 48 of Proceedings of Mochine Learning Research, pp. 40 48, New York, NY, USA, June 2016. PMLR. URL httpss:/pproceedings mlr
/tt.://dd.nn....m....ree//////// www.lrppree//////yapppaa http//////aa1..... html
Yuning You, Tianlong Chen, Yongduo Sui, Ting Chen, Zhangyang Wang, and Yang Shen. Graph contrastive learning with augmentations. In Advances in Neural Information Processing Systems (NeurIPS), volume 33, pp. 5812-5823, 2020.
Junchi Yu, Jian Liang, and Ran He. Mind the label shift of augmentation--ased graph ood generalization. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 2023. doi:
IEEE,
Marvin Zhang, Henrik Marklund, Nikita Dhawan, Abhishck Gupta, Sergey Levine, and Cholsca Finn. Adaptive risk minimization: Learning to adapt to domain shift. In Advances in Neural Information Processing Systems, volume 34, pp. 23664 23664-23678, 2021.
Tong Zhao, Yozen Liu, Lconardo Neves, Oliver Woodford, and Meng Jiang. Data augmentation for graph neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 11016- 11024, 2021.
16

---

Published in Transactions on Machine Learning Research (03/2026)
Yusheng Zhao, Changhu Wang. Xiao Luo, Junyu Luo, Wei Ju, Zhiping Xiao, and Ming Zhang. Traci: A data-centric approach for multi-domain genera cintrolization graphs. In Proceedings of the AAAT Conference on Artificial Intelligence, volume 39 of AAAI-25 Technical Tracks, pp. 13401 13401, 2025. doi: 10.1609/ aaai.v391...34663. URL httpps///di. org/ 10. 1609/aaai. aaai.v39112 v39112.33463
Qi Zhu, Natalia Ponomareva, Jiawei Han, and Bryan Perozzi. Shift-robust gnns: Overcoming the limitations of localized graph training data. In Advances in Neural Information Processing Systems (NeurIPS), 2021a.
Yanqiao Zhu, Yichen Xu, Feng Liu, Jin-Hee Cho, Shu Wang, and Hao Peng. Graph contrastive learning with adaptive augmentation. In Proceedings of the Web Conference (WWW), pp. 2069 2080, 2021b.
Yun Zhu, Haizhou Shi, Zhenshuo Zhang, and Siliang Tang. MARIO: Model agnostic recipe for improving ood generalization of graph contrastive learning. In Proceedings of the ACM Web Conference 2024 (WWW 244, pp. 300-311, 2024.
Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. Adversarial attacks on neural networks for graph data. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Dala Mining, pp. 2847 2856, 2018.
A Appendix
A.1 Dataset Statistics
Detailed statistics for the citation network datasets used in experiments provided in Table 10
Table 10: Statistics of the citation network datasets used for domain generalization.
Dataset
Abbrev.
# Nodes
# Edges
# Features
# Classes
ACMv9
A
9,360
15,602
6,775
5
Citationvl
C
8,935
15,113
6,775
5
DBLPv7
D
5,484
8,130
6,775
5
B Reproducibility Statement
All datasets used in this study are publicly available and cited appropriately. Specifically, the citation network datasets (ACMv9, DBLPv7, Citationvl) follow the splits and preprocessing from prior works (Chen al.
2025: Wu et al. 2022 Other benchmark datasets like Cora, Amazon-Photo Twitch-explicit, Facebook- 100. Elliptic, and Arxvv are standard benchmarks with established splits detailed in Section 5 and Table with references to their original sources.
Our model, EdgeMask- D implemented in Pyrorc using PyTorch Geometrie. Key architectural details (GAT: 4 layers, heads, dim fim/hcad; MaskNet: projection 128 dim, MLP with one 64-dim hidden layer) and training hyperparameters (Adamn optimizer, LR 10-3 for citation nets, WD 5 10-4 200 epochs, 10 10-3 sparsity, Ndescent 5, Noscent 1) provided in Section 5 and Appendix B Specifics for feature edge generation (kNN: k010, cosine; Spectral: K_ = 100 clusters, RBF kernel, sample ratios y = 0.1) are also detailed. Ablation studies in Appendix F further explore hyperparameter sensitivity.
The source code for our experiments, including scripts for data loading, model training, and evaluation, is provided the anonymized URL: https: //githubb www.rrspaawy//e/aeeeee /TMRR This repository contains instruc- tions to reproduce all main results and ablation studies presented. The computational experiments were run NVIDIA 2080 GPUs.
17

---

Published in Transactions on Machine Learning Research (03/2026)
B.1 Time Complexity Analysis
We now provide a time-complexity analysis for the three proposed variants of our EdgeMask-DG framework. Throughout this analysis, consistently use the following notation: N = represents the number of nodes, M = E) is the count of original edges, and F denotes the input feature dimension. The mask-projection dimension is P, while H signifies the hidden size per GAT head, with h attention heads and L GAT layers. The training regimen includes D TaskNet. ("descent") steps and U MaskNet ("ascent") steps per epoch. This process is repeated for K source-domain graphs over a total T training epochs. Additional edges introduced by kNN and spectral clustering are denoted EKNN and Espec respectively. The total number of edges in the graph used for computation is M M FANN + Espec-
Each training epoch executes D + U inner loops, iterating over the K source graphs. Within each such inner loop, the computational costs are primarily composed of four components. First, the mask projection step incurs a cost of O(N . F. P). Second, the MaskNet forward pass requires O(M P)- Third, the TaskNet. forward and backward passes, which involve a stack of GATConv layers, cost O M (h (h-H)). Finally, computing losses and penalties (cross-entropy and sparsity regularization) takes O(N + M). Summing these, and noting that the O(N + M) term is dominated by others (assuming P 2 and LhH 2 1), one inner step has an asymptotic cost of
ONNFP + MP + LMhH)..
Consequently, a full epoch, encompassing all K graphs and D + U inner loops, costs
O(D+ MP + LMhH)).
1. EdgeMask-De DG (base, no extra edges)
For the base EdgeMask-DGi variant, no additional edges are precomputed or added, so Mr = -M. The precomputation cost therefore zero. The per-epoch complexity O(DD + U) K (NFP MP +LMHH). Over T training epochs, the overall complexity is
(N)) MP LMhH)).
2. EdgeMask- DG* (kNN only)
In the Ddg variant augmented solely with kNN edges, we first precompute the kNN graph for each of the K domains. Using standard implementation like kneighbors graph, this takes O(N2) per graph, leading to total precomputation cost of O(K.2). These ΣANN edges are then added to the original M edges, so M MM The per-epoch training cost becomes O((++U) K (MFP+(M+ The overall complexity is the sum of precomputation and total training costs:
O(KN2 +
(NFP (M + ERNN) + L(M + ERNN)HH)).
3. EdgeMask-DG* (kNN + spectral)
When both kNN and spectral odges are incorporated, the precomputation phase more intensive. For each graph, spectral edge generation involves constructing an affinity matrix and performing eigen-decomposition, costing O(N3), followed by edge sampling, which is typically O(N2). Thus, spectral precomputation is O(N3) per graph. The kNN precomputation remains O(N2) per graph. Across K graphs, the total precomputation cost is OKK(N + N2)), which simplifies to O*) With these additional Espec and FANN edges, the total edge count becomes M = M + FRNN + Espec- The per-epoch training cost is O(D+U)) K (NFP + MP LMhH)). The overall complexity therefore
O(K N3 + T(D + +U) (NFP + (M + ELNN + Espec) P + L(M + ERNN + Ht)
18

---

Published in Transactions on Machine Learning Research (03/2026)
Worst-case Simplification
Under worst-case assumptions where added kNN and spectral edges result in dense graphs, i.., ELNN. Espec O(N2), the total edge count M becomes O(N2). In this scenario, the dominant, term the per-epoch complexity for all variants, when summed over T epochs, is (T (D+U) K L LhH N2). For the EdgeMask- DG* (kNN spectral) variant, the procomputation cost is O(KN9). Comparing these, the heaviest sccnario across all variants and phases is dictated by the spectral precomputation and the dense-graple training, leading to overall worst-case complexity of
O(K + +((+4)KLMNN+)
Simplification with Default Hyperparameters
We now simplify the complexity expressions by substituting default hyperparameter values commonly used in our experiments and then dropping negligible terms.
The cost for one inner loop over a single graph, including four components (Mask projection, MaskNet forward, TaskNet forward/backwar backwardd and is NFP + MP + LMhH + N + M. The total training cost over T epochs, D + inner loops per epoch (where D = 5 descent and U = ascent steps, so D + = =), and K 3 source graphs, is
Common Starting Point for Simplification
train-cost T(D U)K[NFP + MP LMAH N + M].
We use the default constants from our implementation: F 7, P 128, H = 128, 8, and T= 200. Let C1 = (D + U)K 3 18. The term FP + becomes (7 x 128) 11 896 + 897. The term P LhH + bocomes 128 + x4x8x8 128) + 128 4096 + 4225. Substituting these into the training cost formula yields:
train-cost = TC₁ [N(FP 1) + M(P+ + LAH + 1)] 200 x 18[7(897) + M(225)).
The leading numeric factor 200 x 18 x 897 ~ 3.23 x 10 for the N-term and 200 x 18 x 4225 z 1.52 x 10" for the M-term are constant multipliers. Asymptotically, only the terms involving and M (and other variables like T, K) matter, so the training cost broadly ((T((N + +)).
1. EdgeMask-DG (no extra edges) For the base variant, AT M. In sparse graphs like social networks, M cN for a small constant average degree (e.g., 20 -30). The general training cost (TT( + M)), upon substituting M ~ O(N), simplifies to ((TK(N + N)) = ((T.N). Since there no pre-computation cost, this the overall complexity.
EdgeMask-DG: OKTN)
This simplified form depends on the number of nodes N, the number of domains K, and the number of epochs T.
2. EdgeMask-DG* (kNN edges only) The pre-computation for kNN graphs (e.g. k 10) is O(KN2). During training, kNN adds FRNN = kN edges (assuming undirected edges, this is a constant degree addition). Thus, M M + ERNN (c + N)N ((N) M cN. The training cost therefore remains O(TКN). To compare magnitudes, for graph with N = 10, 000, and with T 200, K 3: The pre-computation cost KN 3 x (104)² 3 10a. The training cost KTN 3 x 200 x 1 6 109. The quadratic pre-computation cost clearly dominates the training cost.
EdgeMask-DG* (kNN): O(KN2)
The dominant variables N and K.
19

---

Published in Transactions on Machine Learning Research (03/2026)
3. EdgeMask-DG* (kNN + spectral) The pre-computation for spectral clustering is O(N3) per graph (dominated by eigen-decomposition)) leading to total pre-computation cost. of O(K Spectral clustering can add Espec = pN² edges (e.g., with default = 0.1), making the graph dense. Thus, M M + ERNN + Espec = O(N) + + + = O(N3). The training cost O(TK(N + +M) becomes O(TK(N + ) = O(TKN2). Comparing magnitudes with N = 10, 000,00, T = 200, K = 3: The pre- computation cost KN = 3 x (104)3 x 10 The training cost KTN = 3 x 200 x (10t)² = 6 x 10 The cubic pre-computation cost is again the bottleneck by a significant margin.
EdgeMask-DG* (kNN + (rectral):O(KN)
The complexity is primarily determined by N and K.
C Theoretical Analysis: Robust Optimization Perspective
We provide a theoretical foundation for EdgeMask-DG" by framing its adversarial training as solving robust optimization problem over edge masks. This perspective highlights how the method encourages robustness to structural perturbations.
C.1 Problem Setup
Let g' = -V,E", X) be an enriched graph instance with N = |V] nodes and m |8 edges. Let Y be the node labels. The Tas So maps the graph features X and an adjacency structure (s) modulated by an edge mask s E 1] to node logits. The average cross-entropy loss on this graph is denoted by:
{(o, :- 1 E (V(X, (M)) N OEV
We define uncertainty set Sp for the masks based & sparsity budget, p E (0, 1]:
Sp = ss E [0.1)
1 ||s/] s sp]. where ||s|||
Σ
m
80-
Consider the robust optimization problem of finding the mask s E Sp that maximizes the TaskNet's loss for a fixed A:
P(0) max {(fo s).
(P)
sES,
The goal robust training is find parameters 0 that minimize this worst-caso loss: ming P(0).
C.2 Lagrangian Duality and Penalized Objective
We demonstrate that the constrained maximization problem equation P is equivalent to an unconstrained maximization problem with & penalty term, achieved through Lagrangian duality.
Lemma C.1 (Lagrangian Upper Bound). For any Logrange multiplier AL 2 0 and any fixed 0, the worst-cas case loss P(0) max {(fo.s) s) upper-boundee bounded by the dual function D()=;0):
P(0) D(A=;0) max (e(Fo.s) + A sE(0.1]
m (111511--)) x)]
(5)
Consequently, P(0)= S min 20 D() Equality, P(0) min D(LL; 0), holds (i.e., strong duality) if () is concave and other regularity conditions are met. However, since {(fo,)) (which involves GNN computations and cross-entropy loss) is generally non-concave in s, we only have weak duality (the upper bound).
20

---

Published in Transactions on Machine Learning Research (03/2026)
Proof. The primal problem is P(0) max, ((fo,s) subject to [0. 1| and g(s) :. ||s|| p 0. The Lagrangian is [(s, AL; 0) = s( s) + (L = {(fo, s) + dy + ||s|| p), for X 2 0.
The dual function D(A 0) = max ((s, AL; AL; Since f(fo s) is contimuuus and [0, 11 is compact, the maximum attained.
For any feasible for the primal problem (i.e., s Sp: so g(s) - 0) and any dz 2 0:
((fe,)) S () Ang(s)% since X 0 and g 0 = -Arg(s) 20
The lerm (s) is non-negative. More accurately, E(Se: s) & C(s, A1; because )LO(() S 0. This seems off for maximization. Let's restate for standard weak duality in maximization. For any s' E Sp (feasible for primal) and any dr 0:
(-
(1 |s'll1 -P) m
((fo,s') S E(foos'' de
because X 2 O and ( || 0) s Then,
((fers) + d (=ll -0) ) s(fe,s') s max sE|0,1]m
D()c:
Since this holds for any feasible s', it holds for the s* that maximizes E(fo,s') over Sp- Thus, P(O) maxses, {(fe.) S D(A2;0) for any d 2 0. This implies P(0) S minx, D()L; f), which is the statement of weak duality.
Strong duality, P(0) = minx,20 D(Az;0), holds if the primal problem is a convex optimization problem (i.e., maximizing a concave function over a convex set) and satisfies constraint qualifications (e.g., Slater's condition). In our case, E(fe, s) is generally non-concave due the non-linear GNN and the convex (not concave) nature of the cross-entropy loss with respect to logits, which themselves non-lincar functions of s. Therefore, strong duality is not guaranteed. The saddle-point formulation presented previously relied on strong duality and thus may not hold in the general non-concave case. Thus, to show the intuition behind the proposed method, we show this analysis on a concave surrogate as well.
C.3 Interpretation and Connection to Algorithm 1
Lemma C.1 establishes that the dual function 0)) provides an upper bound on the true robust objective P(O). Our algorithu aims to find parameters (0, Φ, v)) that optimize a related penalized objective.
A Algorithmm immplmmnnss an alternating gradient descent-ascent procedure. For fixed sparsity hyperparameter Aalg 2 (this the À used in Eq. g and Algorithm D.. the algorithm seeks parameters (#". ",,,"""", ,v*) such that:
0* minimizes 8*) given s* ma ab (+).
(Ø", ,²" minimizes -((for, + Xalg mcan(s) over masks s generated by ma This is equivalent to maximizing {(Jo-s)) - dalg. mean(s).
The MaskNet's objective (maximization form: E(Ja, >utg mean(s)) targets the inner maximization of Lagrangian-like expression max,[e(fe.st Anir [[]]]] This corresponds to the term {(fe,) + ( p) from D(Az; 8) if we associate >ulg/m m with -dy/m (for maximization of loss) or dL/m (for minimization of negative loss), and note that the term -AtØ is constant with respect to for a fixed d and thus dropped during the MaskNet's optimization of s.
th
C.4 Analysis of a Concave Surrogate Inner Game (s is discrete add relaxation)
While the true loss function s(fe,)) generally non-concave s, we can gain further insight by analyzing a simplified surrogate problem where the inner objective is concave, This allows us to establish strong duality and derive closed-form optimal mask providing intuition for the behavior of the MaskNet.
21

---

Published in Transactions on Machine Learning Research (03/2026)
Consider an affine approximation of the loss function e(fo, s) lincarized around 0:
((o.s) E( V=((So,0)
(6)
This surrogate loss s) affine in s, and therefore also concave in Let (0) v., 0) be the gradient of the original loss with respect to the e-th mask component, evaluated at 0. Then {(e..) = {(ee, 0) + Ex=1 (0)
C.4.1 Optimal Mask for the Penalized Surrogate Problem
We first analyze the optimal mask for a penalized version the surrogate problem, which directly relates to the objective optimized by the MaskNet in Algorithm [ were using this surrogate loss. The MaskNet's update rule (Eq- 3 aims to maximize Las(So, s) mean(s). Using the surrogate loss and defining the penalty strength Aalg/m (where Aal is the sparsity hyperparameter from Algorithm D the objective becomes:
max sc
{(Jo,s) - Σ
(7)
Substituting Eq. equation
m
m
((fo. 0) + Σ (e) Sc
max ME m
8c
e(fo, 0)+
max BE[0.1]
(ce 7)
This is linear program in where each se is constrained to [0, and can be chosen independently to maximize its term in the sum. For each edge
(0) > 0, the term (c)(0) T) maximized by setting 8 =
If cf)) < 0, the term (O) T)88. is maximized by setting 8 0.
If (0)) - = 0, any 8e [0, 1] optimal for that term; we can choose 8 by convention (or 2 =1).
Thus, the optimal mask s* for the penalized surrogate problem has components:
8t)) that solves Proposition C.2 (Optimal Mask for Penalized Surrogate). The optimal mask s* = -si,...,8",) the penalized surrogale problem defined in equation 7 is given by:
1 V E(oo >|.
where A is the effective sparsity threshold and I[[] is the indicator function (equal to 1 if the condition is true, 0 otherwise).
Proof. As derived above, maximizing Σm (0) T)ss subject to se E [0, involves setting se if its coefficient (0) r) is positive, and 8, 0 if its coefficient is negative. This directly leads to $: = ((c > 7].
C.4.2 Strong Duality for the Constrained Surrogate Problem
Now; consider the original constrained robust optimization problem P(0) from Eq. equation 4 (or equation but using the surrogate loss t
Paurr (0) == max ((foss))) where S, = fs 10, _ - |||| S p].
99)
xES,
22

---

Published in Transactions on Machine Learning Research (03/2026)
Since s) is affine (and thus concave) in s, and the feasible set Sp is convex and compact, strong duality holds for this problem (e.g., Slater's condition is satisfied if p > 0 by choosing s = 0 as a strictly feasible point). Therefore, P Paurr (0) = minxp20 (AD; 0), where D Daurr (AD; 0) is the dual function:
D Paurr(ADi0) sC(0.1]"M
max
((fo,)) - AD
1
Σ e=1
5e
AD
max 10
e(So, 0) Σ
(0)
Σ
Xnp
e=1
==1
ce( AD
= =ffoo 0) + App + max
Sc.
(10)
==|0,1
e=1
Let TD Ap/m. The inner maximization maXge((01]=" D-=1 (ca(0) is solved by sτ(An) = (0) > rp]
m
The optimal s** for the constrained problem P. Paurr(() (0) will be St" = (f) > XD/m], where >b is the optimal dual variable that minimizes D Daurr(Ap;0) This XD is chosen such that the resulting mask s** satisfies the budget constraint 1 Σ S = (if the constraint is active) or 1 5x <p (if XT = =0)
m
C.4.3 Connection to the EdgeMask-DG* Algorithm
The EdgeMask-DG"* algorithm does not directly use the surrogate loss i based V.l(fo, 0). Instead, its MaskNet uses the gradients of the true loss {(fe,s) evaluated at the current mask Scure, i.e. Vgl(fo, Seurr)) to guide its updates. However, the analysis of the surrogate problem provides a valuable intuition:
demonstrates that if the loss landscape were simple (affine), the optimal strategy for the MaskNet. (given a fixed sparsity penalty 7) would be hard thresholding of edges based on their gradient scores (e)) Edges whose inclusion contributes to increasing the loss by more than t are kept (se 1), while others are discarded (8, = 0).
The EdgeMask-DDG" algorithm, through its adversarial training and the MaskNet's objective (Eq. 3). can be viewed as attempting to learn such a thresholding behavior, but adapted to the complex, non-linear landscape of the true loss s)) The MaskNet computes edge scores Sue (Eq. 1 basod on node features and aims to find masks that are impactful yet spanse.
The gradient ascent performed by the MaskNet on -Lts + A mean(s) iteratively seeks regions where a sparse mask maximally degrades TaskNet performance. The structure of the optimal mask for the surrogate (Proposition C.2) suggests that such masks would prioritize edges with high "scores" (sensitivity of loss) relative to the sparsity cost.
Therefore, while the true optimization is more complex, the concave surrogate analysis reinforces the idea that the MaskNet learns to identify and exploit critical subset of edges, akin to a learned thresholding mechanism based on edge importance and sparsity budget. This iterative process, acting on the true non-concave loss but sharing similaritics with the optimal strategy for the concave surrogate, drives the TaskNet to become robust to the removal/doss minnoval/downwwiieee weightttg of edges deemed less critical or potentially spurious by this adaptive thresholding. It is important reitcrate that strong duality and the closod-form solution of Proposition G.2 apply to the simplified concave surrogate problem. Hence, these specific results apply only to the surrogale, not directly to the original non-concave game, for which we only have weak duality.
D KKT Analysis of the Adversarial Mask Optimization
We analyze the propertics of the optimal mask s* that the MaskNet implicitly soeks for a fixed TaskNet Sa- This corresponds to solving the inner maximization problem from the robust optimization perspective (Problem equation P in Section
max SER
{(fe,s)
(11)
23

---

Published in Transactions on Machine Learning Research (03/2026)
subject to:
(1( 1 m
3e p 0
(12)
m e=1
he (s) = Se 1
< 0 E mL.
(13)
(s) 8. S
Ve E m!
(14)
where 8) the TaskNet loss, m = [ and (0, 1] is the sparsity budget. We assume {ffo, s) is continuously diffcrentiable with respect s.
To analyze the solution s", formulate the Marush-Kuun-Tuckee (KKT) conditions. It is standard to formulate KKT conditions for minimization problems. We consider the equivalent minimization problem:
min
s))
RER
subject the same constraints equation equation equation
Let À 2 0 be the Lagrange multiplier for the sparsity constraint 91 (s) 0. Let /4. 2 be the Lagrange multipliers for the upper bound constraints (s) 0. Let ve 0 be the Lagrange multipliers for the lower bound constraints (s(s) S O.
The Lagrangian function is:
m L(s, u, -(((os)) Ag)(s) Σ pcha(s) + Σ vcck((s)
=-((ooss) +1
Se P
+ 2 Me(se -1)
Vel (=(-
The KKT conditions for optimal solution s" (assuming constraint qualifications like Slater's condition 0 is strictly feasible for if p > 0) are:
hold, which is true here
Stationarity: The gradient of the Lagrangian with respect to s must be zero at s":
VgL(s" X3, 14, v²) =
For each component Se, this gives:
al(fo.s))
1
+ x*
+ P.(1) + 1-1 =
Ose
Rearranging:
fl(fe,s")
X + r v Ve E (1.....m)
(15)
Ose
Primal Feasibility: The solution
must satisfy all original constraints:
S PS0
(16)
0=1
1 50 0
Ve
(17)
5 50
Ve
(18)
3. Dual Feasibility: All Lagrange multipliers must be non-negative:
X 2 0,
r 2 0,
ve 2
Ve
(19)
24

---

Published in Transactions on Machine Learning Research (03/2026)
4. Complementary Slackness: The product of each multiplier and its corresponding constraint value must be zero at s":
1
X
p
0
(20)
e=1
(s 1) 0 5/ (-8)
Ve ve = 0 Ve
(21)
(22)
It is important to note that because the inner maximization problem equation 11 (maximizing {ffo, s))
is gencrally non-convex with respect s (due to the non-lincar GNN operations), the KKT conditions
characterize necessary conditions for local optima or stationary points. They do not guaranlee that a point satisfying them is the global maximizer of the MaskNet's objective. During the adversarial training (Algorithm D, the MaskNet's optinization step (ascent) aims to find such point, typically approximating a local maximum but the above analysis provides a theoretical justification for the algorithm's objective.
D.1 Interpretation of KKT Conditions
We analyze the stationarity condition equation slackness conditions equation 21 and equation 22 Let g fe(fo.")) 85.
15
based on the optimal value 8 using the complementary denote the gradient of the loss with
respect to the mask value of edge al the optimum.
Case 1: Interior solution (0 < S < 1)
From equation 22 since se > 0, we must have v/a = O.
From equation 21 since se < 1 (i.c., 8% - 1< 0), we must have μa = 0.
Substituting Pe and ve = into the stationarity condition equation 15
ab(fo. s*) X m
g
Use
Interpretation: For edges that are partially masked, the marginal increase in loss obtained by slightly increasing the mask value Se must exactly equal the marginal "cost" imposed by the sparsity constraint, represented by X* ///m.
Case 2: Fully masked edge (s = 0)
From equation 21 p0 - - 2 = 0, which implies μ4 =
Condition equation 22 sv* = 0) automatically satisfied, and we only know vs 2
Substituting P into the stationarity condition equation
al(Jo,s") X m v
ge
Ose
Since v. 2 0, this implies:
De(fo. 5*)
X
Ose
m
Interpretation: An edge is completely removed (s = 0) if the marginal gain in loss from slightly increasing mask value less than or equal to the marginal sparsity cost X² Xtmm. Including this edge even partially is not "worth" the sparsity cost incurs.
Case 3: Fully included edge =1 1) From equation 22
(1) = 0, which implies =
Condition equation 21 (s" - 1) = 0) is automatically satisfied, and we only know μ 0.
Substituting ve into the stationarity condition equation 15
g: aE(So,s))
X
Øs:
m
25

---

Published in Transactions on Machine Learning Research (03/2026)
Since μ 2 O, this implies:
fo. s*)
X
8oe
Interpretation: An edge is fully kept (s- 1) if the marginal gain in loss from increasing its mask value (evaluated at Se 1) is greater than equal to the marginal sparsity cost X ///m. The contribution of this edge to maximizing the loss outweighs its sparsity cost.
Furthermore, the complementary slackness condition equation 20 tells us about the optimal Lagrange multiplier X for the sparsity constraint:
p), then we must have X = 0. In this scenario, the sparsity budget is not limiting, and the optimal mask s* is determined solely by maximizing {(fo,) within the box [0, 1) The conditions simplify: ge = 1r -
If the sparsity constraint is inactive at the optimum (i.c., in E <
If the sparsity constraint is active at the optimum (i.e., 1 = p), then X can be positive (X* 2 0). In this case, X /mmm acts as non-zero threshold on the loss gradient ös, required to include an edge (s" > 0). A higher X (resulting from tighter budget p) imposes stricter requirement for including edges.
E Gradient Analysis of the Adversarial Game
We analyze the gradient dynamics of the alternating optimization procedure used in Algorithm [T understand how the interplay between the TaskNet (fo) and MaskNet (ma.v) encourages robustness. Let Lete (0, d, e) denote the classification loss for given graph instance, making the parameter dependencies explicit:
Lets (0, = Lote (Jo(X, s)s Y), where (X,,((EE)))
Let R(o,)) v) denote the sparsity regularization term:
A
R(ó, vb = A mean(s) |
Se, where s = =mg.v =X,,
e=1
E.1 TaskNet Gradient Update
The TaskNet aims to minimize the classification loss given the current fixed mask s generated by the MaskNet. The objective for the TaskNet update step is:
Jrack (0) = (o, Prixed Vixea)
The gradient used for updating the TaskNet parameters is:
ga
V VaJrask = (f
(23)
where s = Mogaad (.) is treated as constant input (edge attributes) during this computation. This is a standard gradient computation for the GAT model fo operating on the graph G' with edge attributes s. The update rule is 0 + nege. This step adapts the TaskNet to perform well on the graph structure as perturbed by the current adversarial mask.
E.2 MaskNet Gradient Update
The MaskNet aims to find mask parameters (o, v) that maximize the TaskNet's loss (for fixed 0) while minimizing the average mask value (promoting sparsity). This formulated as minimizing the following objective:
Jmask (1), vb) -Lats (ftisedd &. 1)) R(g, 1b)
26

---

Published in Transactions on Machine Learning Research (03/2026)
The gradient used for updating the MaskNet parameters (ø, 1/) is BB.v = V mask Φ). We compute this gradient using the chain rule. Let (Ø. 1)) denate the combined MaskNet parameters.
V Dpsmask (6, ()) Vp!-CalsOOixedd 6, v)] + ppl v)]
Term 1: Gradient of Negative Loss The loss Lote depends on p through the mask = mp(-).
V vpl-Cat Ccla = - -VVpfcctee
Applying the chain rule:
Ohics Os
Vp CPCCo Os Op
Here:
0Cale Vshats the gradient of the Task 's loss with respect to the mask vector s. This a row ds
vector of size x m. Its e-th element, 0Cate represents the sensitivity of the loss to the mask value ds.
of edge e.
vps is the Jacobian matrix of the MaskNet output s with respect to its parameters p. Its size Up
m lpl. The (eth) element. 8s. Sp,
The product is a row vector of size 1 x (p), reprosenting the gradient the loss with respect to the MaskNet parameters.
V Ppl-Lol = - (VoLoll)
Term 2: Gradient of Sparsity Regularizer
R(o, vb) = m c=1
Σ sc(p)
Vp(R(o,))) = Vp
(p(p)
V p (p))
=
m
Using Jacobian notation:
m
[pls =1m(Vps)
where 1 is an m column vector of ones. So,
VpIR(e, v)] X 1 ( m
Combined MaskNet Gradient: Substituting the terms back:
Ba. = Vp mmssa (10 46)
= -V (vps) + A 1s 1 (Vps)
m
= -V + 11T) (Vps)
(24)
The update rule for the MaskNet is p < p norgo, (transposing the row gradient to column vector for parameter updates).
27

---

Published in Transactions on Machine Learning Research (03/2026)
E.3 Interpretation of Gradient Dynamics
The gradient update for the MaskNet parameters p (Ø, 1)) is driven by two main components, filtered through the MaskNet's Jacobian Vps:
1. Loss Sensitivity (-VaLat): This term pushes the MaskNet paramcters to change the mask s in a direction that increases the TaskNet loss Lats- Specifically, if aLaie is positive (increasing 8e increases loss), Use
the gradient term - &Lote is negative, encouraging changes in p that lead to decrease in 8g. Conversely, if Asc
8Cas is negative (increasing Se decreases loss), this term encourages an increase in Se. The MaskNet learns 88.
to identify edges where the TaskNet is sensitive.
2. Sparsity Pressure ( A ) This term provides a constant positive pressure in the objective gradient m (or negative pressure in the parameter update direction -Ba.)) for all mask values Se: scaled by A/m. It encourages the MaskNet parameters to change in ways that. decrease all 8, values, promoting overall sparsity.
The MaskNet paramcters p = (Ø, v) are updated to minimize Jmask (0, x) = Lete (fixed &, 4)) + R(Ø, v).
The gradient g is given by Equation equation 24 Since Algorithm 1 employs an optimizer that minimizes Jaask the parameter update is p +- p 1000 8
To understand how this update affects individual mask values Se, consider the term Q. 0Cai + de. m. which
is the e-th component of the vector (-Va + 1²) in Equation equation 24 The change in is driven by this Qa through the MaskNet's Jacobian vps. Specifically, because the MaskNet uses a sigmoid output for Se (Equation D. the entries of the Jacobian term Appr-siggmod activation for s.] are non-negative. Assuming the parameters p primarily influence 8e through its pre-sigmoid activation in a way that 0s. components öp (relevant to s,) don't invert the sign of Q 's influence, the effective change As, will have a sign opposite to Qe Thus, the MaskNet will tend to:
Increase se if Qe < O, which means 0Cate > A (the loss increase from s. outweighs the sparsity dse cost, so making& 8a larger helps minimize L.s)).
DCais < A (the loss increase from se is less than the sparsity Decrease Se if Qe > which means ds. cost, or Se helps decrease loss, so making smaller helps minimize Jmask).
This aligns with the MaskNet's objective of minimizing (m 4) Lots (fixed, á, 1)) + R(Ø, 1)). (Note: If using hard-concrete gate or other mechanisms where the Jacobian Os/Op might have more complex sign interactions, this direct interpretation would need adaptation.)
Interaction Driving Robustness (Hypothosis): The adversarial process unfolds as follows:
1. The MaskNet identifies edges where the current TaskNet fo is vulnerable (high positive &Cete) ) or
De.
edges that are not sufficiently beneficial (low negative aLai) relative to the sparsity cost A/m. It decreases the corresponding 8, values.
da
2. The TaskNet receives this challenging mask and updates its parameters via VoLas to minimize the loss despite the mask.
3. This adaptation by the TaskNet changes its internal representations and consoquently alters the loss sensitivity VaCats for the next MaskNet update.
Mcase for a non-robust. TaskNet. We hypothesize that domain-specific, spurious edges exhibit high positive De, The MaskNet consistently targets these edges for down- doin-weigh The TaskNet, to survive, must adapt 0 such that its predictions become less dependent on these specific edges, thereby reducing the magnitude of &Cas for those spurious edges. This forces the TaskNet to rely more heavily on other structural patterns, Us.
potentially the domain-invariant ones, whose presence consistently Icads to a decrease in loss (negative (fate) even under perturbation. The gradient dynamics thus provide mechanism pushing the TaskNet towards representations robust to the removal of likely domain-specific structural features identified by the MaskNet.
28

---

Published in Transactions on Machine Learning Research (03/2026)
F
Additional Ablation Studies: Hyperparameters for Graph Enrichment
This scction dctails further ablation studies hyperparamcters related to the graph enrichment process (kNN and Spectral clustering edges) used in BdgeMask-DG** All experiments, unless otherwise specified, use the default hyperparameters outlined in the main paper. Teave-one-out cross-validation across the three citation datasets ("acmv9", 'citationvl', 'dblpy7') is used for these hyperparameter sweeps. (Results are from single runs; std. dev. over multiple seeds would be beneficial for robustness assessment.)
F.1 KNN K Ablation
We study the effect of varying the number of neighbors ('knnk') used for constructing the kNN feature graph within our full (SeeMMaaaDDGGGppet-H three leave-one-ont scenarios presented in Table 11 and Figure 2
method. The spectral K is fixed at 100. Average results over the
Table 11: KNN K ablation results (average over Scenarios). Performance metrics (Avg Micro-F1, Avg Macro-F1) are reported. The default value (k-10) and the best average performance (k=3) are highlighted.
kNN K
Avg Micro-F1
Avg Macro-F1
3.0000
0.7383
0.7260
5.0000
0.7263
0.7115
10.0000
0.7307
0.7175
20.0000
0.6871
0.6428
50.0000
0.6362
0.5166
Average F1 Score
0.7
0.6
0.5
3
5
20
50
kNN (Number of Neighbors)
Avg Micro-F1
Avg Macro-F1
Figure Average performance vs. kNN K (number of noighbors). Results averaged over 3 lcavo-onc-out, scenarios.
The choice of 'knnk' significantly impacts performance. Figure 2 shows clear trend: performance is best for small values of K (peaking K=3 average), remains relatively good at K=10 (our default), but drops sharply for larger values (K=20 and K=50). The particularly steep decline in Macro-F1 for K=50 suggests that including too many neighbors introduces excessive noise or spurious connections, polentially linking nodes across class boundaries and harming the classification of minority classes. This indicates that the kNN edges are most beneficial when they capture strong, local similarities basod on node features. While K=3 yields the best average, K=10 provides a good balance and strong performance, justifying its use as a default, although smaller values might offer further improvements.
Analysis:
29

---

Published in Transactions on Machine Learning Research (03/2026)
F.2 Spectral K Ablation
We analyze the effect of varying the number of clusters ('spectralk') used for generaling spectral feature edges in our full EddeMMas-DDG*Sppeee leave-onc-out sconarios, including training time, are presented in Table 12 and Figure 3
method. The kNN K is fixed at 10. Average results over the three
Table 12: Spectral K ablation results (average over 3 Scenarios, except k=50). Performance metrics (Avg
Micro-F1, Avg Macro-F1) and average training time (s) are reported. The default (k=100) and best performing (k=200) values are highlighted.
Spectral Avg Micro-F1
Avg Macro-F1
Avg Train Time (s)
50.0000
0.7126
0.6551
393.30
100.0000
0.7463
0.7354
363.0800
150.0000
0.7404
0.7268
323.6400
200.0000
0.7498
0.7364
309.3200
250.0000
0.7457
0.7339
325. 225.2400
300.0000
0.7449
0.7301
318.8800
0.76
380
Average F1 Score
0.75
360
Avg Train Time (s)
0.74
340
0.73
320
0.72
300
100
150
200
250
300
Spectral K (Number of Clusters)
Avg Micro-F1
Avg Macro-F1
Avg Train Time
Figure 3: Average performance and training time spectral K. F1 scores (left axis) and training time (right axis) averaged over three leave-one-out runs (note: k = 50 omitted due to 0OM).
30


Reviews:
[{"review_id": "kib54fsJ6z", "reviewer": "Reviewer_joP6", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper introduces a min–max adversarial framework for graph domain generalization, where an edge masker generates sparse masks to perturb the graph structure and force a task GNN to rely on robust and domain-invariant substructures. The authors further propose EdgeMask-DG*, which augments the graph with feature-derived edges (via kNN and spectral clustering) before applying adversarial masking, thereby capturing invariances that may not be visible in the original topology. The method is theoretically motivated from a robust optimization perspective and is instantiated with a GAT backbone.\n\n**Strengths:**\n\n1. Clear and well-motivated adversarial framework for structural domain generalization.\n1. Integration of feature-based enrichment with adaptive masking is novel and empirically strong.\n1. Theoretical justification (robust optimization, KKT analysis) provides useful insights.\n1. Extensive evaluation across citation networks, social networks, e-commerce graphs, and temporal datasets.\n1. Strong performance on citation and artificial transformation benchmarks, setting new state-of-the-art results.\n\n**Weaknesses:**\n\n1. Computational overhead is high, particularly with spectral clustering (O(N³)), which limits scalability.\n1. Results are mixed on certain datasets (e.g., Facebook-100, temporal graphs), indicating the approach is not universally superior.\n1. Many experimental results are reported with single runs; multi-seed averages would strengthen reproducibility.\n1. The method relies on the assumption that node features remain stable across domains, which may not always hold.\n1. Some parts of the related work are underdeveloped, especially on concurrent domain generalization techniques.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The claims of improved domain generalization under structural shifts are convincingly supported by results on citation and artificial benchmarks, where the gains over prior methods are substantial. The theoretical analysis is consistent with the adversarial training formulation. However, since performance varies on some datasets and results are often from single runs, the claims should be interpreted as conditional rather than universal.", "audience_yn": "Yes", "audience_explanation": "Graph domain generalization is an important and timely research direction. The idea of adversarial edge masking combined with feature-based graph enrichment is original and likely to be of strong interest to the graph ML and robustness communities. The empirical findings would be useful both for researchers designing robust GNNs and for practitioners handling heterogeneous graph data.", "requested_changes": "**Critical (required for acceptance):**\n\n1. Report code and results averaged across multiple random seeds for all main tables to ensure reproducibility.\n1. Discuss scalability limitations more explicitly and consider approximate methods to mitigate the O(N³) spectral clustering cost.\n1. Clarify the assumption that node features are stable across domains and its practical implications.\n\n**Non-critical (would strengthen the paper):**\n\n1. Expand the related work discussion to cover concurrent DG methods more thoroughly.\n1. Improve the clarity of Figure 1 with additional annotations and explanations.\n1. Include runtime and memory comparisons with baselines to quantify the computational overhead.\n1. Discuss applicability to graph-level tasks and potential extensions beyond node classification.", "broader_impact_concerns": "No direct ethical concerns are identified", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "sx9hypiBXs", "reviewer": "Reviewer_fVBh", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a framework to train robust GNNs for out-of-domain generalization. The key idea is to use adversarial training to identify and remove a small amount of edges that are most critical to the downstream classification task. Thus, the GNN predictor learnt from the pruned graph is claimed to be robust to domain shifts. \n\nArchitecture contribution: the GNN predictor integrates the soft edge mask generated by the adversarial module by modifying the edge attention in GAT. The edges with small masked values will have little contribution in message passing. \n\nOptimization: the adversarial objective integrates a penalty term to enforce sparsity. The authors theoretically show that such objective ensures edges that are effective in reducing classification loss will be pruned. \n\nData augmentation: the design integrates edge augmentation strategy to connect nodes with high embedding similarity (via kNN or spectral clustering).\n\nEvaluation: extension experiments have been performed to study the effectiveness under different generalization scenarios (various domains, temporal graphs, etc).", "claims_and_evidence_yn": "No", "claims_explanation": "The theoretical analysis seems to be sound. I agree that the proposed penalty term can enable the Mask Net to remove edges that contribute most to the prediction loss reduction. \n\nHowever, the main question is that why learning a GNN on such a pruned graph can improve \"robustness\". Assume certain edges are critical to all domains. The adversarial Mask net will learn to prune such edges, which will hurt performance on both the source domains **and** the (unknown) target domain. It seems a good strategy would be to remove edges that are critical to the source domain learning but not critical to the target domain. When the target domain is unknown, there simply lack information on which are the good edges to prune. \n\nEdge augmentation is a technique orthogonal to the adversarial training. More importantly, edge augmentation itself may arguably introduce noise. It is thus unclear whether what edges (i.e., the original or the augmented edges) are pruned by MaskNet. \n\nExperiments\n* The proposed method does not consistently show significant gains over baselines. For example, the performance gain in Table 2 is not particularly strong. In Table 4, the proposed method is significantly worse than a few baselines. \n* The proposed method only work on small graphs, due to the N^2 complexity. The evaluated datasets are also very small. In realistic scenarios (e.g., real-world citation networks), the graphs can be orders of magnitude larger. Then it becomes unclear how the proposed method would scale.", "audience_yn": "Yes", "audience_explanation": "The paper discussed OOD generalization of graph neural networks, which is an important problem in graph deep learning.", "requested_changes": "* Please explain why pruning the edges most critical to the source domains will improve generalization to the target domain. In particular, why such process does not depend on the target domain. \n* Please discuss the relationship between edge augmentation and edge pruning. How these steps potentially interfere with each other? It would be better to compare baselines with edge augmentation, or the proposed method without edge augmentation.", "broader_impact_concerns": "NA", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "gMAxD0yNdF", "reviewer": "Reviewer_zQuS", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes EdgeMask-DG and its extension EdgeMask-DG* for graph domain generalization under structural shifts. The core idea is a min–max adversarial training game in which a MaskNet produces sparse, continuous edge masks that perturb the graph structure, while a TaskNet (GAT) is trained to remain accurate under these worst-case perturbations; the mask is injected directly into attention and message passing, thereby suppressing low-score edges during aggregation. EdgeMask-DG* further enriches the graph by uniting original edges with feature-derived edges (kNN and spectral clustering) so the model can rely on invariances in P(X) even when the native topology is noisy or domain-specific. A robust-optimization view (saddle-point with an \\ell_1 mask budget) justifies the procedure. Experiments on citation, social, and temporal benchmarks report state-of-the-art performance (e.g., the “Total Avg” F1 across ACM/DBLP/Citation is 73.81 vs. 73.28 for GRM; on Cora OOD the worst-case accuracy is 78.0%, +3.8pp over 74.2), with ablations indicating that both enrichment and adversarial masking are necessary; code is released。", "claims_and_evidence_yn": "Yes", "claims_explanation": "1. The paper clearly states the DG assumptions P(X) and P(Y\\!\\mid\\!X) invariant while P(A\\!\\mid\\!S_i) varies, aligning the enrichment rationale with the problem setting. The adversarial objective and its robust-optimization interpretation are spelled out, including the sparsity-regularized inner problem and KKT-based interpretation. The GAT integration shows exactly how masks affect attention logits and messages. These pieces make the learning mechanism and its intended invariances clear.\n2. On the ACM/DBLP/Citation leave-one-domain-out protocol, EdgeMask-DG* reaches the highest total average F1 (73.81) and leads on AD→C and CD→A; it is competitive on AC→D. On Cora and Photo, it achieves strong min/avg scores; on Twitch, it has the best average ROC-AUC; however, on FB-100 it is notably weaker, which the authors acknowledge. For temporal datasets (Elliptic, ArXiv), the method is competitive with verifiable baselines, while GRM reports higher numbers but is flagged as unverifiable (no public code). This pattern supports the claims of robustness to structural shifts while transparently exposing a failure case (FB-100) and a comparison caveat (GRM).", "audience_yn": "Yes", "audience_explanation": "The paper addresses a salient open problem—DG for GNNs under structural shifts—and proposes an architecturally simple, broadly applicable recipe (mask-aware GAT) backed by a robust-optimization view and consistent improvements on standard DG suites. The explicit treatment of structure sensitivity and the demonstration across heterogeneous datasets (citation, social, temporal) should interest readers in robustness, graph learning, and domain shift. The released code further enhances utility and reproducibility for the community.", "requested_changes": "Backbone-controlled comparisons. Since EdgeMask-DG* uses GAT (naturally synergistic with edge weights), please add GAT-backbone variants of strong baselines (e.g., EERM, GraphAug) or, conversely, report EdgeMask-DG* with GCN/GIN backbones to disentangle method gains from backbone advantages.  \n\nMulti-seed and significance. Report mean ± std over multiple seeds for all tables (not only some) and include paired significance tests for key comparisons (especially Table 2 and Table 3 entries). The manuscript itself notes missing std. dev. for certain ablations.\n\nClarity on training alternation and gradients. In Algorithm 1, explicitly state the stop-gradient/“detach” behavior when alternating (mask fixed during TaskNet descent; TaskNet fixed during MaskNet ascent), as already hinted in the prose, and ensure this is reflected in the pseudo-code. Provide the exact update counts used per dataset。", "broader_impact_concerns": "Fairness under structural pruning. Adversarial masking may systematically down-weight minority or sparsely-connected subpopulations, potentially reducing their accuracy if their edges look atypical; discuss mitigation (e.g., mask regularizers per group or fairness constraints). (Mechanistically, masks suppress edges in attention and messages.)  \n\nPrivacy and inference risks. Constructing feature-derived edges (kNN, spectral) can implicitly infer links that users did not expose, risking privacy leakage when features encode sensitive traits; this should be acknowledged, especially for social/financial graphs. \n\nDistributional assumptions. The approach relies on P(X) and P(Y|X) invariance; deployment in settings where features drift (e.g., sensor changes) could lead to overconfidence. Clarify safeguards (drift detection, mask recalibration).", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)