Title: V-InFoR: A Robust Graph Neural Networks Explainer for Structurally Corrupted Graphs
Venue: NeurIPS 2023
Accepted: yes
Keywords: Explainable AI

Graph Neural Networks

Machine Learning
Abstract: GNN explanation method aims to identify an explanatory subgraph which contains the most informative components of the full graph. However, a major limitation of existing GNN explainers is that they are not robust to the structurally corrupted graphs, e.g., graphs with noisy or adversarial edges. On the one hand, existing GNN explainers mostly explore explanations based on either the raw graph features or the learned latent representations, both of which can be easily corrupted. On the other hand, the corruptions in graphs are irregular in terms of the structural properties, e.g., the size or connectivity of graphs, which makes the rigorous constraints used by previous GNN explainers unfeasible. To address these issues, we propose a robust GNN explainer called V-InfoR. Specifically, a robust graph representation extractor, which takes insights of variational inference, is proposed to infer the latent distribution of graph representations. Instead of directly using the corrupted raw features or representations of each single graph, we sample the graph representations from the inferred distribution for the downstream explanation generator, which can effectively eliminate the minor corruption. We next formulate the explanation exploration as a graph information bottleneck (GIB) optimization problem. As a more general method that does not need any rigorous structural constraints, our GIB-based method can adaptively capture both the regularity and irregularity of the severely corrupted graphs for explanation. Extensive evaluations on both synthetic and real-world datasets indicate that V-InfoR significantly improves the GNN explanation performance for the structurally corrupted graphs. Code and dataset are available at https://anonymous.4open.science/r/V-InfoR-EF88

V-InFoR: A Robust Graph Neural Networks Explainer for Structurally Corrupted Graphs

Abstract

GNN explanation method aims to identify an explanatory subgraph which contains the most informative components of the full graph. However, a major limitation of existing GNN explainers is that they are not robust to the structurally corrupted graphs, e.g., graphs with noisy or adversarial edges. On the one hand, existing GNNexplainers mostly explore explanations based on either the raw graph features or the learned latent representations, both of which can be easily corrupted. On the other hand, the corruptions in graphs are irregular in terms of the structural properties, e.g., the size or connectivity of graphs, which makes the rigorous constraints used by previous GNN explainers unfeasible. To address these issues, we propose a robust GNN explainer called V-InfoR 3 . Specifically, a robust graph representation extractor, which takes insights of variational inference, is proposed to infer the latent distribution of graph representations. Instead of directly using the corrupted raw features or representations of each single graph, we sample the graph representations from the inferred distribution for the downstream explanation generator, which can effectively eliminate the minor corruption. We next formulate the explanation exploration as a graph information bottleneck (GIB) optimization problem. As a more general method that does not need any rigorous structural constraints, our GIB-based method can adaptively capture both the regularity and irregularity of the severely corrupted graphs for explanation. Extensive evaluations on both synthetic and real-world datasets indicate that V-InfoR significantly improves the GNN explanation performance for the structurally corrupted graphs.

1 Introduction

Nowadays, graph data is ubiquitous in various domains, such as citation networks [1, 2, 3], social networks [4, 5], and chemical molecules [6]. GNN has manifested promising performance in many graph tasks, e.g., node classification [7, 8], link prediction [9], and graph classification [10, 11], by aggregating node features in light of the topological structures. Similar to other deep learning models, GNNmodels also have the defect that they are non-transparent, and the prediction results lack humanintelligible explanations [12]. Precise explanations can not only make people better understand GNN predictions but also assist GNN designers in detecting underlying flaws and purifying them.

(a) Raw graph

𝑮

𝜙 𝐺

= ො 𝑦

(

b) Minor corruption

𝜙 𝐺′

= ො 𝑦

(c) Severe corruption

𝜙 𝐺′′

≠ ො 𝑦

GNN explainer aims to identify an explanatory subgraph, whose components exert vital influence on the prediction of the full graph [13]. Existing GNN explanation methods generally allocate significance scores for each component of the graph, and a subgraph with the highest score is extracted as the explanation of the whole graph [14]. They optimize the allocation of the significance scores by minimizing an explanation loss function [15, 13]. The final explanation provided by GNN explainer includes a subgraph structure along with the corresponding node features.

However, a major limitation of existing works is that they mostly focus on designing effective significance score allocation methods, but ignore such a critical problem: Whether and to what extent a structurally corrupted graph will affect the performance of the GNN explainer? In many real application scenarios, the graphs may contain various corruptions, such as noise [16, 17] and adversarial edges [18, 19, 20]. Existing methods directly adopt the raw graph features [21, 22, 15, 23] or the latent graph representations [13, 24, 25] as the input of the explainer model, and thus the output explanation may not be reliable when the input is corrupted. Previous work has shown that the explanation of deep neural networks is fragile to attacked images [26]. Thus whether the structurally corrupted graphs will remarkably affect the performance of the GNN explainer and how to address it is an interesting problem, yet has not been fully studied and remains an open research issue.

This paper for the first time investigates how to construct a robust GNN explainer for structurally corrupted graphs. As illustrated in Figure 1, based on whether the prediction of the downstream task (e.g., graph classification) is changed, the structural corruptions of a graph can be categorized into minor corruptions and severe corruptions. In Figure 1(a), ϕ denotes the GNN model to be explained, and G is the raw graph. Figure 1(b) shows the case of the graph with minor corruption G ′ , which is not so intense that the predicted graph label remains the same as the raw graph. Figure 1(c) shows the case of the severely corrupted graph G ′′ where the corruption is devastating enough to the GNN and thus results in a different prediction. Based on this example, we argue that a robust GNN explainer should satisfy the following two requirements. First, the minor corruption should be considered as redundant components and filtered by the explainer as they do not affect the final prediction. Second, the severe corruption should be identified by the explainer as part of the explanation since they are the non-ignorable reason that changes the final prediction. However, it is non-trivial to meet the two requirements simultaneously due to the following two challenges.

Robust graph representation extraction to eliminate the minor corruptions . As we discussed before, existing works directly use the raw graph features or the latent graph representations of each single graph as the explanation input, which will raise the risk of the GNN explainer overfitting to corruptions [26]. This is because the raw graph features can be easily corrupted by noise or adversarial attacked edges. The latent graph representations have been proved vulnerable to structural corruption [27, 20]. How to extract a robust graph representation that can effectively filter the minor corruptions while preserving the vital information for GNN explanation exploration is challenging.

Structural irregularity of the severe corruptions . The corruptions may be of different sizes or consist of several disconnected parts in the graphs, i.e., they are irregular [28]. For example, in molecule chemistry, the corruptive functional groups differ largely in terms of size (e.g., -Cl and

-C 10 H 9 in solubility analysis). Moreover, a molecule containing multiple functional groups which are disconnected from each other is common in the real-world. To meet the second requirement, the structural irregularity of severe corruption should be identified by the GNN explainer. Hence it is not reasonable to adopt some predefined rigorous constraints, e.g., size constraint or connectivity constraint that are commonly used in previous explainers, to the explanations of corrupted graphs. How to design a more general objective function to adaptively capture the structural irregularity of severe corruption is also challenging.

To address the two aforementioned challenges, we propose a robust GNN explainer for structurally corrupted graphs called V-InfoR (Variational Graph Representation based Information bottleneck Robust explainer). Specifically, V-InfoR contains two major modules. (1) Robust graph representations extractor . In this module, we take insights of variational inference [29, 30] to model the statistical characteristics that are shared by all the observed graphs, i.e., the mean and the standard deviation. The statistics are capable of capturing the uncertainty and variability of the observed graphs. Based on the statistics, a variational graph distribution is induced, which can effectively model the common features of all the graphs and filter the minor corruption. The variational graph representations provide a more robust graph representation for the downstream explanation generator. (2) Adaptive explanation generator . To address the irregularity issue of the severe corruptions, we propose an Adaptive Graph Information (AGI) constraint. The AGI constraint directly restricts the information carried by the explanation without any rigorous assumptions on the structural properties (e.g., size or connectivity) of the explanation. By incorporating the AGI constraint, we formulate the GNN explanation exploration as a Graph Information Bottleneck (GIB) optimization problem to adaptively capture both the regularity and irregularity of the severely corrupted graphs.

Our main contributions are summarized as follows:

This work for the first time studies the negative effect of both minor and severe structural corruptions on existing GNN explainers, and proposes a robust explainer V-InfoR to effectively handle the two types of corruption.

We novelly propose to incorporate variational inference to explore GNN explanation. A variational inference based robust graph information extractor is proposed to mitigate the uncertainty and variability of minor corruptions when extracting the critical graph information.

We generalize the GNN explanation exploration by introducing an adaptive graph information constraint, which can capture both the regularity and irregularity of the corrupted graphs. We also theoretically derive the variational bound of this objective to make it feasibly optimizable.

Extensive experiments on one synthetic dataset and three real-world datasets demonstrate the superiority of V-InfoR over state-of-the-art GNN explanation methods.

2 Preliminary and Problem Statement

In this section, we will first provide the quantitative evidence that existing GNNs explainers are fragile to structurally corrupted graphs. Then we provide a formal statement of the graph explanation problem. See Appendix B for the basic notations.

2.1 Are existing GNN explainers robust to corruptions?

To study whether existing GNN explainers are robust to corruptions, we evaluate the performance of six state-of-the-art GNN explainers when minor corruption and severe corruption are injected into the raw graphs, respectively. We use the synthetic BA-3Motifs dataset [15], which is a widely used benchmark dataset for GNN explanation. To investigate the minor corruption, we select the corrupted graphs whose predictions are unchanged after randomly flipping 20% edges. For the severe corruption, we use the SOTA graph adversarial attack algorithm GRABNEL, which formulates the attack task as a Bayesian optimization problem [18]. The attack budget of GRABNEL means the highest percentage of the attacked edges. We use a 10% attack budget here, which is able to change the prediction of the selected graphs and thus can be considered as the severe corruption. F NS score is used as the evaluation metric and a higher F NS score means a better explanation performance [25]. The formal definition will be given later in Section 4.1.

5

1

2

3

4

𝑥

1

𝑥

2

𝑥

3

𝑥

4

𝑥

5

Variational Inference of

Latent Variable

1

2

5

3

4

𝝁 𝑇

=

1

2

3

4

𝝈 𝑇

=

[mean]

[deviation]

Variational

𝑍

Edge Representation

MLP

Latent

parameters

𝛼

1

𝛼

2

𝛼

3

𝛼

4

𝛼

5

𝛼

6

𝑝

1

𝑝

2

…

𝑝

6

Edge

probability

Sampled

explanation

Latent

Distribution

Aggregate

Combine

GNN

𝑦

Aggregate

Combine

GNN

𝑦𝑆

5

3

4

𝑥

3

𝑥

4

𝑥

5

𝐺𝑆

𝐺

Optimizing

GIB Loss

Robust graph representation extractor

Adaptive explanation generator

Full graph

𝐸

5

The result is presented in Figure 5 of Appendix C. The histograms of the three colors represent the explainer performance on raw graphs, graphs with random noise, and attacked graphs, respectively. One can see that both the minor corruption (20% random structural noise) and the severe corruption (10% GRABNEL attack) remarkably degrade the explanation performance. Minor corruption brings about an average performance degradation of 31.15% for the six GNN explainers, and severe corruption results in an average performance degradation of 40.64%. The experimental result verifies that both the minor and the severe corruptions do significantly affect the performance of existing GNN explainers. Therefore, a robust GNN explainer is required for the structurally corrupted graphs.

2.2 Problem formulation

Formally, given the GNN model ϕ to be explained and the input graph G = ( X , A ) , the explanation provided by the GNN explainer is a subgraph G S = ( X S , A S ) . A S is a subset of the original adjacent matrix A and contains the key structure that determines prediction largely and X S is the features of nodes which associates with A S . Existing researches show that topological information is critically important to graph classification [27, 13]. Hence, our V-InfoR focuses on the structural corruption when exploring explanation. We deem an explanation G S sufficient when it can produce the same prediction as using the full graph, and deem it necessary when the prediction will change if it is removed from the full graph [25]. An ideal explanation should be both sufficient and necessary. Formally, the sufficient and necessary conditions [25] are formulated as follows, respectively,

̸

where ˆ y = argmax c ∈C P ϕ ( c | X , A ) in Formula (1) and (2).

3 Methodology

Figure 2 illustrates the overall architecture of V-InfoR, which is composed of two key modules, the robust graph representation extractor and the adaptive explanation generator. As shown in the upper part of Figure 2, the robust graph representation extractor takes the full graph G as input, and two GCN encoders are adopted to infer the statistics of G 's latent distribution (i.e., mean and standard deviation). The variational node representations, which are sampled from the latent graph distribution, will induce the edge representations. The edge representations are then fed into the adaptive explanation generator which is shown in the lower part of the figure. A multi-layer perceptron

projects the edge representations into the probability of each edge. The explanation subgraph G S is generated on the basis of this probability. Finally, the proposed novel Graph Information Bottleneck (GIB) objective is optimized, which is defined over the full graph prediction ˆ y and the explanation subgraph prediction ˆ y S . Next, we will introduce the two modules in detail.

3.1 Robust graph representation extractor

Specifically, we introduce a variational auto-encoder (VAE) [30] to deduce the statistics in the variational distribution of the minorly corrupted graphs. For a set of observed graphs G = { G k = ( X k , A k ) } |G| k =1 , variational inference assumes that they are generated by a latent random process, involving a latent continuous random variable z [29, 30]. This random process contains two steps. First, a value z k is generated from a prior distribution p ( z ) . Then the graph G k is generated from a conditional distribution p ( G | z ) and observed by us. Variational inference aims at identifying the posterior distribution p ( z | G ) , i.e., inverting the distribution of latent variable z from the observed graphs 4 . However, the true posterior distribution p ( z | G ) is unknown. A feasible method is introducing a variational distribution q ( z ; G ) to approximate p ( z | G ) [28]. This work assumes that q ( z ; G ) is a Gaussian distribution N ( µ , σ 2 ) and increases the similarity between q ( z ; G ) and p ( z | G ) . The similarity measurement is Kullback-Leibler divergence,

We substitute the unknown p ( z | G ) for p ( z , G ) /p ( G ) . Finally, the objective function of the robust graph representation extractor to be minimized can be formulated as

where p ( z ) is the standard Gaussian distribution N ( 0 , I ) . See Appendix A for detailed derivation.

We refer to the latent variable z as a variational representation because it contains the indicative information of the observed graphs. We also refer to the model that computes the distribution q ( z ; G ) as an encoder , since given a graph G , it produces a distribution over the latent variable z , from which G could have been generated. Similarly, p ( G | z ) is referred to as a decoder , since given a code z it produces the probability of the possible graph G .

In our implementation, we employ a 3-layer GCN as the encoder and a simple inner product as the decoder. The first two layers of GCN aim to aggregate and combine the information from the graph. The third layer consists of two separate graph convolution operators to calculate the mean µ and standard deviation σ of q ( z ; G ) , respectively. This procedure can be formulated as

The variational inference procedure endows q ( z ; G ) vital graph information and is insensitive to minor corruptions. Hence the sampled graph representation z which follows q ( z ; G ) is more robust. Next, the robust representation z will be fed into the explanation generator for explanation exploration.

3.2 Adaptive explanation generator

As the second challenge stated before, severe corruptions should be identified as part of the explanation, but they are usually irregular in terms of size, connectivity or some other structural properties. The rigorous constraints of the structural regularity adopted in previous works [15, 13, 25] are thus not feasible for the severe corruptions. Hence, a new GNN explanation exploration objective function is required to adaptively capture the irregularity of the severe corruptions. Inspired by the Graph Information Bottleneck (GIB) principle [31, 32], we propose to introduce an Adaptive Graph Information (AGI) constraint in exploring GNN explanation. On the one hand, the AGI constraint functions as a bottleneck to directly restrict the information carried by the explanation G S , instead

of simply restricting the size or connectivity of G S . Without any predefined structural regularity constraints, our method can more effectively capture the irregularity of the explanation caused by the severe corruptions. On the other hand, since the information measurement of the explanation G S can be continuously optimized, the AGI constraint can adaptively cover the discrete rigorous constraints [28]. To this end, we formulate the GNN explanation problem as a GIB-guided optimization task to adaptively generate the explanations.

The insight of the GIB-guided optimization is that the explanation G S of graph G should contain the minimal sufficient components of G [31]. GIB principle facilitates G S to be informative enough about the prediction ˆ y of G ( sufficient ). GIB principle also inhibits G S from preserving redundant components which is irrelevant for predicting G ( minimal ). To this aim, the GIB-guided optimization task of G S is formally defined as follows,

where MI( · , · ) denotes the mutual information. The second term MI( G,G S ) measures the vital graph information carried by the explanation G S , which functions as the AGI constraint. Nevertheless, the GIB-guided explanation exploration task in Formula (8) cannot be directly extended to a continuous optimization procedure, because both G and G S have discrete topological information which is difficult to optimize over. We resort to Gilbert random graph theory [33] which argues that an arbitrary graph G can be represented as a random graph variable, and each edge of G is associated with a binary random variable r to reveal its existence. Additionally, the existence of one edge is conditionally independent of the other edges. r ij = 1 means there is an edge ( i, j ) from v i to v j , otherwise r ij = 0 . To sum up, an arbitrary graph G can be represented as

For the binary variable r ij , a common instantiation is the Bernoulli distribution r ij ∼ Bern( θ ij ) , where θ ij = p ( r ij = 1) is the probability of edge ( i, j ) existing in G. However, the Bernoulli distributiont cannot be directly optimized. To address this issue, we apply categorical reparameterization [34] to the Bernoulli variable r ij . The continuous relaxation of r ij can be formulated as

where we let the latent parameter α ij = log θ ij 1 -θ ij . τ controls the approximation between the relaxed distribution and Bern( θ ij ) . When τ approaches 0, the limitation of Formula (10) is Bern( θ ij ) .

According to Formula (10), the Bernoulli parameter θ ij is indeed associated with parameter α ij . In our implementation, we use a multi-layer perceptron (MLP) to compute α . The MLP takes the variational node representation z as input and concatenates the representations of two nodes v i , v j as the representation of the corresponding edge ( i, j ) , which can be formulated as

where [ · , · ] is the concatenation operator.

Based on α and Formula (10), we obtain the probability matrix M p whose elements indicate the existence of the corresponding edges. Next, we can sample the explanation G S based on the probabilities in the matrix M p as follows,

So far, we have derived the optimizable representation of G S in Formula (8). However, the optimization is still challenging since the distributions p (ˆ y | G S ) and p ( G S ) are intractable.

Fortunately, following the variational approximation proposed in [35], we can derive a tractable variational upper bound of GIB in Formula (8). For the first term -MI(ˆ y, G S ) , a parameterized variational approximation p ϕ (ˆ y | G S ) is introduced for p (ˆ y | G S ) to get the upper bound as follows,

where p ϕ (ˆ y | G S ) is the GNN model and H (ˆ y ) is an entropy independent of G S . For the second term, we introduce q ( G S ) for the marginal distribution P ( G S ) [28], and the upper bound is

where p α ( G S | G ) represents the explanation generator and q ( G S ) represents the prior distribution sharing a similar spirit of assuming standard Gaussian prior [28]. See Appendix A for the detailed derivation. Finally, we obtain the variational upper bound of the GIB Formula (8) as follows,

where q ( G S ) is usually set as

where C is a constant that decided by the hyper-parameter π .

Note that there are no rigorous constraints imposed in Formula (15). The second term actually functions as an adaptive constraint that inhibits G S from containing useless information. The risk of ignoring the irregular severe corruptions in the final explanation G S can also be largely mitigated.

To achieve a robust GNN explainer for all the corruption situations, the two proposed modules are trained jointly by minimizing the following overall objective function,

4 Experiment

4.1 Experimental setup

Following the standard procedure of GNN explanation [15, 2], we conduct two steps in the experiments: (1) training a base GNN model for prediction, and (2) generating explanations for this base model. For the first step, the base GNN model is trained to simulate the third-party predictor which is independent of the GNN explainers. We take the trained GNN model as an oracle during the explanation generation, i.e., input the graph (no matter clean or corrupted) and get the prediction. In the second step, we simulate the corruptions by introducing random noise or adversarial attack to the graph structures. The random noise represents the corruptions that naturally exist in real-world which affects each graph component without any distinction. The noise ratio controls the percentage of randomly flipped edges. The adversarial attack represents the man-made malicious corruptions and the attack budget is the highest percentage of attacked edges.

Metric. For a quantitative explanation evaluation, we report the probability of sufficient P S , the probability of necessary P N and the F NS scores. See Appendix D.1 for the detailed definition.

Dataset. We evaluate the proposed V-InfoR and baseline explanation methods on one synthetic dataset and three real-world datasets. The synthetic dataset is BA-3Motifs introduced in [36]. Three real-world datasets are Mutag, Ogbg-molhiv and Ogbg-ppa.

Baseline. The comparable baseline explainers include gradients-based methods GradCAM [21] and IG [22], surrogate method PGM-Explainer [37], and perturbation-based methods GNNExplainer [15], PGExplainer [2] and ReFine [36].

The detailed descriptions of datasets, baselines, and base GNN models are given in Appendix D. The ablation study is presented in Appendix E. We also report the visualized cases of GNN explanation for qualitative analysis in Appendix F.

4.2 Quantitative Evaluation on Graphs with Random Noise

We report the result on the graphs with 20% random structural noise corruptions in Table 1. Specifically, we randomly select the edges according to the noise ratio and flip the selected ones.

The result shows that V-InfoR is able to improve the explainer performance on the four datasets, with the overall metric F NS score improvement at least by 9.19% for the BA-3Motifs dataset and the highest improvement by 29.23% for the Mutag dataset. The V-InfoR improves the performance remarkably for Mutag by 29.23% and Ogbg-molhiv datasets by 15.65%, since the irregularity of the corruptions in chemical molecule structure is more obvious than the other types of graphs (motifs in BA-3Motifs and biologically associations in Ogbg-ppa), and V-InfoR is able to effectively capture

the irregularity. For the BA-3Motifs and Ogbg-ppa datasets with less obvious irregularity, V-InfoR can still achieve a performance improvement, since the information constraint is general enough to cover the rigorous constraint and thus avoid performance degradation.

One can also see that the raw features based explainers, including GradCAM, IG, GNNExplainer, and PGM-Explainer, perform poorly in small/medium-scale datasets (BA-3Mmotifs, Mutag and Ogbgmolhiv). This may be because the raw features are more easily to be corrupted in small/medium-scale graphs. Since the graph representation is more difficult to learn in the large-scale graph, PGExplainer and ReFine that relie on latent graph representations are unable to well explain large-scale graphs for the Ogbg-ppa dataset. V-InfoR adopts the robust graph representation which is sampled from a variational distribution containing common information shared by large amounts of graphs, and thus achieves an overall better performance. Furthermore, one can note that all baseline GNN explainers achieve a high P S , while the P N is relatively low. This phenomenon implies that the sufficient condition is easier to satisfy than the necessary condition.

As shown in Figure 3, we also evaluate V-InfoR and baselines under different noise ratios ranging from 0 to 0.30, which reverals the tendency of explainer performance with the increase of noise ratio. In real application scenarios, it is intractable to separate the minor and the severe corruptions, and both may exist simultaneously. Different noise ratios indicate different mixing ratios of the two corruptions. Note that F NS scores with zero noise ratio represent the result on raw graphs without any corruption. It shows that V-InfoR still achieves the best performance when no noise is added (noise ratio = 0). This reveals that even without any corruption, the robust representation extractor still extracts vital common graph information and the explanation generator adaptively identifies the explanations with regular structural properties.

4.3 Quantitative Evaluation on Graphs with Attack Corruption

The adversarial attack corresponds to the malicious corruption painstakingly customized by the attacker. Here we use the SOTA graph classification attack algorithm GRABNEL [18], whose attack budget is the highest percentage of attacked edges. GRABNEL employs a surrogate model to learn the mapping from an attacked graph to its attack loss and optimizes the attacked graph iteratively via an adapted genetic algorithm until successful attack or budget exhaustion. Considering the overhead of executing GRABNEL, we run the attack algorithm only on the BA-3Motifs and Mutag datasets. We report the results with 5% and 10% attack budgets in Table 2.

The result reveals that InfoR achieves an overall superior performance over the other baselines in terms of all metrics. As the attack budget grows from 5% to 10%, though the GNN explanation task becomes harder (all metrics decrease), the performance improvement of V-InfoR becomes more significant than baselines. This shows that V-InfoR can effectively mitigate the negative influence of the structural corruptions. For the Mutag dataset, the performance improvement on the graphs with GRABNEL attack (13.96%) is less significant than that on the graphs with random noise (29.23%). This gap can be attributed to the difference between adversarial attack and random noise. Although the adversarial attack corruption is devastating to change the model prediction, they are subtle and introduce as less irregularity as possible to the raw graphs.

4.4 Hyper-parameter analysis

We further analyse the effect of three parameters on the model performance, τ , β and π . τ controls the approximation degree of r ij distribution to Bernoulli distribution, which ranges in [0 . 1 , 0 . 5] . β controls the balance between the strength of information restoring (i.e., min -MI(ˆ y, G S ) ) and the strength of information filtering (i.e., minMI( G S , G ) ). π represents the prior Bernoulli probability, which controls the distribution of q ( G S ) .

Figure 4 shows the influence of the three hyper-parameters on V-InfoR for the BA-3Motifs and Mutag datasets. One can roughly archieve the following three conclusions. First, V-InfoR is not so sensitive to β that controls the strength of AGI constraint, which verifies the adaptability of our proposed constraint. Second, a suitable value of τ is around 0.3, which means the best balance between the continuity of Formula (10) and the approximation degree is achieved when τ = 0 . 3 . Third, there is no obvious pattern shown in Figure 4(c) for the choice of π in Formula (16), which means that a reasonable π may largely depend on the specific dataset.

5 Related Work

Early attempts to explain GNN simply transfer gradients-based methods to graph data, and they regard the gradients of nodes and edges as significance scores [14]. Though efficient and intuitive, the explanations based on gradients are unavoidably suffered from gradients saturation [25]. Surrogate methods [37, 23] are also adopted in GNN explanations. Yet limited by simple models that function as surrogates, these approaches are unable to capture topological structure which plays an important role in GNN predictions [13, 27]. Currently, the most concerned GNN explanation methods are perturbation-based. By intervening components in the graph, such as deleting (or adding) edges

(or nodes), and monitoring the change of the corresponding prediction, perturbation-based GNN explanation methods [15, 13, 24, 38] optimize the significance scores matrix round after round.

As a classic perturbation-based GNN explanation method, GNNExplainer [15] determines the significant components by maximizing the mutual information between the intervented and the original graphs. It calculates significance scores for both node features and edges, and the components whose scores are below-threshold will be removed. PGExplainer [13] introduces a parameterized neural network to provide significance scores. It demands a training procedure to endow the internal neural network with multi-categorical predicting behavior, and the trained PGExplainer can explain any new graph without retraining. While the previous methods aim to preserve the components that make the prediction invariant, CF-GNNExplainer aims to find the components that will make the prediction change if they are missing [24]. XGNN [39] formulates the GNN explanation problem as a reinforcement learning task. Starting with an empty graph, XGNN gradually adds components until the generated graph belongs to the specified class.

6 Conclusion

In this paper, we propose a robust GNN explainer V-InfoR for the structurally corrupted graphs. V-InfoR employs the variational inference to learn the robust graph representations and generalizes the GNN explanation exploration to a graph information bottleneck (GIB) optimization task without any predefined rigorous constraints. The robust graph representations are insensitive to minor corruptions when extract the common information shared by the observed graphs. By introducing an adaptive graph information constraint, V-InfoR can effectively capture both the regularity and irregularity of the explanation subgraphs. Extensive experiments demonstrate its superior performance and the ablation study further illustrates the effectiveness of two proposed modules.

References

Andreas Nugaard Holm, Barbara Plank, Dustin Wright, and Isabelle Augenstein. Longitudinal citation prediction using temporal graph neural networks. In Proceedings of AAAI , 2022.

Dongsheng Luo, Yuchen Bian, Yaowei Yan, Xiao Liu, Jun Huan, and Xiang Zhang. Local community detection in multiple networks. In Proceedings of KDD , 2020.

Zhoujin Tian, Chaozhuo Li, Zhiqiang Zuo, Zengxuan Wen, Lichao Sun, Xinyue Hu, Wen Zhang, Haizhen Huang, Senzhang Wang, Weiwei Deng, et al. Pass: Personalized advertiser-aware sponsored search. In Proceedings of KDD , 2023.

Feiran Huang, Zefan Wang, Xiao Huang, Yufeng Qian, Zhetao Li, and Hao Chen. Aligning distillation for cold-start item recommendation. In Proceedings of SIGIR , 2023.

Peiyan Zhang, Yuchen Yan, Chaozhuo Li, Senzhang Wang, Xing Xie, Guojie Song, and Sunghun Kim. Continual learning on dynamic graphs via parameter isolation. In Proceedings of SIGIR , 2023.

Nikil Wale and George Karypis. Comparison of descriptor spaces for chemical compound retrieval and classification. In Proceedings of ICDM , 2006.

Hao Chen, Zhong Huang, Yue Xu, Zengde Deng, Feiran Huang, Peng He, and Zhoujun Li. Neighbor enhanced graph convolutional networks for node classification and recommendation. Knowledge-Based Systems , 246:108594, 2022.

Jianan Zhao, Meng Qu, Chaozhuo Li, Hao Yan, Qian Liu, Rui Li, Xing Xie, and Jian Tang. Learning on large-scale text-attributed graphs via variational inference. In Proceedings of ICLR , 2022.

Muhan Zhang and Yixin Chen. Link prediction based on graph neural networks. In Proceedings of NeurIPS , 2018.

Petar Velickovic, Guillem Cucurull, Arantxa Casanova, Adriana Romero, Pietro Liò, and Yoshua Bengio. Graph attention networks. In Proceedings of ICLR , 2018.

Zhongyu Huang, Yingheng Wang, Chaozhuo Li, and Huiguang He. Going deeper into permutation-sensitive graph neural networks. In Proceedings of ICML , pages 9377-9409, 2022.

Karen Simonyan, Andrea Vedaldi, and Andrew Zisserman. Deep inside convolutional networks: Visualising image classification models and saliency maps. In Proceedings of ICLR , 2014.

Dongsheng Luo, Wei Cheng, Dongkuan Xu, Wenchao Yu, Bo Zong, Haifeng Chen, and Xiang Zhang. Parameterized explainer for graph neural network. In Proceedings of NeurIPS , 2020.

Phillip E. Pope, Soheil Kolouri, Mohammad Rostami, Charles E. Martin, and Heiko Hoffmann. Explainability methods for graph convolutional neural networks. In Proceedings of CVPR , 2019.

Zhitao Ying, Dylan Bourgeois, Jiaxuan You, Marinka Zitnik, and Jure Leskovec. Gnnexplainer: generating explanations for graph neural networks. In Proceedings of NeurIPS , 2019.

Enyan Dai, Charu Aggarwal, and Suhang Wang. Nrgnn: Learning a label noise resistant graph neural network on sparsely and noisily labeled graphs. In Proceedings of KDD , 2021.

Marco Fiorucci, Francesco Pelosin, and Marcello Pelillo. Separating structure from noise in large graphs using the regularity lemma. Pattern Recognition , 98, 2020.

Xingchen Wan, Henry Kenlay, Binxin Ru, Arno Blaas, Michael A. Osborne, and Xiaowen Dong. Adversarial attacks on graph classification via bayesian optimisation. In Proceedings of NeurIPS , 2021.

Kai Zhou, Tomasz P. Michalak, and Yevgeniy Vorobeychik. Adversarial robustness of similaritybased link prediction. In Proceedings of ICDM , 2019.

Daniel Zügner and Stephan Günnemann. Adversarial attacks on graph neural networks via meta learning. In Proceedings of ICLR , 2019.

Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: visual explanations from deep networks via gradientbased localization. In Proceedings of ICCV , 2017.

Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In Proceedings of ICML , 2017.

Qiang Huang, Makoto Yamada, Yuan Tian, Dinesh Singh, Dawei Yin, and Yi Chang. Graphlime: Local interpretable model explanations for graph neural networks. arXiv , page arXiv:2001.06216, 2020.

Ana Lucic, Maartje A. ter Hoeve, Gabriele Tolomei, Maarten de Rijke, and Fabrizio Silvestri. Cf-gnnexplainer: counterfactual explanations for graph neural networks. In Proceedings of AISTATS , 2022.

Juntao Tan, Shijie Geng, Zuohui Fu, Yingqiang Ge, Shuyuan Xu, Yunqi Li, and Yongfeng Zhang. Learning and evaluating graph neural network explanations based on counterfactual and factual reasoning. In Proceedings of WebConf , 2022.

Amirata Ghorbani, Abubakar Abid, and James Y. Zou. Interpretation of neural networks is fragile. In Proceedings of AAAI , 2019.

Daniel Zügner, Amir Akbarnejad, and Stephan Günnemann. Adversarial attacks on neural networks for graph data. In Proceedings of KDD , 2018.

Siqi Miao, Mia Liu, and Pan Li. Interpretable and generalizable graph learning via stochastic attention mechanism. In Proceedings of ICML , 2022.

David M Blei, Michael I Jordan, and John W Paisley. Variational bayesian inference with stochastic search. In Proceedings of ICML , 2012.

Diederik P. Kingma and Max Welling. Auto-encoding variational bayes. In Proceedings of ICLR , 2014.

Tailin Wu, Hongyu Ren, Pan Li, and Jure Leskovec. Graph information bottleneck. In Proceedings of NeurIPS , 2020.

Junchi Yu, Tingyang Xu, Yu Rong, Yatao Bian, Junzhou Huang, and Ran He. Graph information bottleneck for subgraph recognition. In Proceedings of ICLR , 2021.

Edgar N Gilbert. Random graphs. The Annals of Mathematical Statistics , 30, 1959.

Eric Jang, Shixiang Gu, and Ben Poole. Categorical reparameterization with gumbel-softmax. In Proceedings of ICLR , 2017.

Alexander A. Alemi, Ben Poole, Ian Fischer, Joshua V. Dillon, Rif A. Saurous, and Kevin Murphy. Fixing a broken elbo. In Proceedings of ICML , 2018.

Xiang Wang, Ying-Xin Wu, An Zhang, Xinagnan He, and Tat-Seng Chua. Towards multigrained explainability for graph neural networks. In Proceedings of NeurIPS , 2021.

Minh N. Vu and My T. Thai. Pgm-explainer: Probabilistic graphical model explanations for graph neural networks. In Proceedings of NeurIPS , 2020.

Alexandre Duval and Fragkiskos D. Malliaros. Graphsvx: shapley value explanations for graph neural networks. In Proceedings of ECML/PKDD , 2021.

Hao Yuan, Jiliang Tang, Xia Hu, and Shuiwang Ji. Xgnn: towards model-level explanations of graph neural networks. In Proceedings of KDD , 2020.

Weihua Hu, Matthias Fey, Marinka Zitnik, Yuxiao Dong, Hongyu Ren, Bowen Liu, Michele Catasta, and Jure Leskovec. Open graph benchmark: datasets for machine learning on graphs. In Proceedings of NeurIPS , 2020.

Ekagra Ranjan, Soumya Sanyal, and Partha Pratim Talukdar. Asap: Adaptive structure aware pooling for learning hierarchical graph representations. In Proceedings of AAAI , 2020.

Keyulu Xu, Weihua Hu, Jure Leskovec, and Stefanie Jegelka. How powerful are graph neural networks? In Proceedings of ICLR , 2019.

Thomas N. Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In Proceedings of ICLR , 2017.

Negin Entezari, Saba A. Al-Sayouri, Amirali Darvishzadeh, and Evangelos E. Papalexakis. All you need is low (rank): Defending against adversarial attacks on graphs. In Proceedings of WSDM , 2020.

Wei Jin, Yao Ma, Xiaorui Liu, Xianfeng Tang, Suhang Wang, and Jiliang Tang. Graph structure learning for robust graph neural networks. In Proceedings of KDD , 2020.

A Detailed Derivation

First, we give the detailed derivation of Formula (4). To maximize the similarity between the variational distribution and the true posterior distribution, we minimize the Kullback-Leibler divergence,

Since p ( G ) is independent of z , we get the following derivation,

Next, we deduce the upper bound of -MI(ˆ y, G S ) in Formula (13),

At last, we deduce the upper bound of MI( G S , G ) in Formula (14),

B Basic Notations

The basic notations and descriptions are summarized in Table 3

C Preliminary Experiment

The results of six SOTA GNN explainers on the graphs with minor and severe corruptions is shown in Figure 5. The dertailed analysis in reported at Section 2.1.

D Experiment supplement

D.1 Metric

We formally define the three metrics for explanation evaluation as follows,

̸

where G test is the test dataset. P S measures how faithfully the explanations in simulating the full graph, P N measures the indispensability of explanations, and F NS score is the Harmonic mean of P S and P N , which measures the overall performance of a GNN explanation method.

D.2 Dataset

We next briefly introduce the four datasets. The statistics of the four datasets are shown in Table 4, where the " avg nodes/edges " means the average node/edge number of the graphs and the " split " is the dataset splitting of the training, validation, and testing sets.

BA-3Motifs [36] contains 3,000 synthetic graphs. Each graph adopts Barabasi Albert graphs as the base and attaches each base with one of three motifs: house, cycle, and grid. The synthetic graphs are classified into three classes according to the type of attached motifs.

Mutag [6] contains 4,337 molecule graphs which are classified into two categories in accordance with their mutagenic effect on a bacterium.

Ogbg-molhiv [40] contains 41,127 molecule graphs which are classified into two categories based on whether a molecule inhibits HIV virus replication or not.

Ogbg-ppa [40] contains 158,100 protein-protein association networks in which nodes represent proteins and edges indicate biologically meaningful associations. These association networks cover 1,581 species that belong to 37 taxonomic groups (e.g., mammals and bacterial families). The prediction task is a 37-classes classification to predict which taxonomic group the network is from.

D.3 Baseline

We next briefly introduce the baseline explainers used in our experiments, including the gradientsbased, the perturbation-based, and the surrogate GNN explanation methods.

GradCAM [21] is a gradients-based explanation method. It conducts a weighted summation on the last layer representation to obtain the significance scores. The weights are provided by gradient back-propagation.

IG [22] is a gradients-based explanation method. It calculates the significance scores by conducting path integral of the input feature gradients.

GNNExplainer [15] is a perturbation-based explanation method. It perturbs both the topological structure and the node features to calculate the significance scores and search for explanation subgraphs G S that maximize the mutual information between G S and full graph prediction ˆ y .

PGExplainer [13] is a perturbation-based explanation method. It perturbs the topology and employs a parametric neural network to calculate the significance scores, with the same objective function in GNNExplainer.

ReFine [36] is a perturbation-based explanation method. It applies the pre-training and fine-tuning paradigm to the GNN explanation exploration problem, which promises to offer an all-round inspection of the GNN decision-making process from multi-granularity.

PGM-Explainer [37] is a surrogate explanation method. It trains an interpretable Bayesian network to fit the predicted label of the GNN model.

D.4 Base GNN model

The architectures and downstream task performances of the base GNN models which function as the third-party predictors in our experiments are reported in Table 5.

E Ablation Study

In the ablation study, we create three variants of the full V-InfoR. No-VAE removes the robust graph information extractor, which explores explanations based on the latent representations from the GNN model to be explained. No-GIB replaces the GIB-based optimization objective function with the traditional sparsity-driven mutual information objective function. No-VAE-GIB drops both two proposed modules. We report the performance of full V-InfoR and three variants in Figure 6.

It shows that the performance drops significantly when removing either the robust graph representation extractor or the adaptive graph information constraint. The performance of No-V AE-GIB is the lowest among the variants. As shown in Figure 6, the performance of No-GIB degrades more significantly than No-VAE in all the cases. This implies that the severe corruptions can more significantly affect the GNN explainers than the minor corruptions, which is consistent with the preliminary result in Section 2.1. On the one hand, the improvements from No-VAE-GIB to No-GIB and No-VAE indicate that both of the two modules are helpful to explain the corrupted graphs. On the other hand, the inferiority of No-GIB and No-VAE to the full V-InfoR further reveals that merely adopting one of the two modules is unable to deal with the graphs with two types of structural corruptions.

F Case Study

We give a visualized case study of explanations provided by V-InfoR and five baselines for the BA-3Motifs. Figure 7(a) shows the three types of motifs: cycle, grid, and house. Figure 7(b) shows the explanations on a graph with minor corruptions, whose prediction (cycle class) and ground-truth explanation (cycle) are both unchanged. V-InfoR allocates high significance scores (marked by red lines) to the cycle motif (highlighted by circle) correctly and eliminates the minor corruption successfully. While the other baseline explainers pay little attention to the vital cycle motif and fail to identify it as the explanation. Figure 7(c) shows the explanations of the severely corrupted graph. The raw prediction and raw ground-truth explanation are both associated with the grid motifs (marked by "before corrupted" ), which have been broken by the severe corruption. Since the severe corruption has changed the prediction to house class, the explanation should be the house motif (marked by "after corrupted" ). However, the five baseline explainers still allocate high significance scores to the component of the grid motif. Only V-InfoR succeeds in identifying the house motif (highlighted by circle) as the explanation.

(b). Explanations on graphs with minor corruption (prediction unchanged)

House

Grid

Cycle

Ground-truth

explanation

Before corrupted

After corrupted

Before/after

corrupted

(c). Explanations on graphs with severe corruption (prediction changed)

G Robustness Evaluation

To directly demonstrate the robustness of our proposed V-InfoR, we introduce a robustness evaluation metric [44, 45], which is defined as the performance drop after a certain ratio of noise/adversarial attack is added into the graphs. A smaller performance drop means a more robust model and a negative value indicates that the model can even perform better under noise/adversarial attack.

First, we report the performance drop of V-InfoR and all the baselines in Table 6, with GRABNEL attack ratio set as {2.5%, 5.0%, 7.5%, 10%}. The results show that our proposed method can even improve the explanation performance on Mutag dataset after adversarial attack, while the performance of all the baselines degrade, which can demonstrate the robustness of our model to GRABNEL attack.

As shown in Table 7, we further report the performance drop of V-InfoR and all the baselines with the random noise ratio set as {0.05, 0.10, 0.15, 0.20, 0.25, 0.30}. For the Ogbg-molhiv and Ogbg-ppa, V-InfoR is more robust to the random noise than all the baselines. The result on Mutag indicates that V-InfoR stands among the top-tier robust methods, since the irregularity in chemical molecules is more obvious and significant. This phenomenon implies that our method relies more on capturing the irregularity stemming from graph corruption in order to maintain its robustness. When adding adversarial attack to Mutag graphs, the robustness of our method is more significant, which

verifies our deduction again. For BA-3Motifs, the result shows that our proposed model is within the middle range of the robustness evaluation on BA-3Motifs graphs with random noise. This can be attributed to two main possible reasons. Firstly, the introduction of random noise results in a lesser degree of irregularity compared to adversarial attack and thus the ability of our method to capture irregularities in corrupted graphs does not bring robustness improvement significantly. In contrast, our method showcases greater robustness than the baseline models when exposed to adversarial attacks on BA-3Motifs graphs. This is due to the fact that such attacks will destroy the influential motifs and consequently amplify the level of irregularity. Secondly, the synthetic BA-3Motifs graph itself adheres to a more regular structure than real-world graphs, which adopts a Barabasi-Albert graph as the base and attaches the base with one of three motifs. Consequently, the potential for our method to achieve robustness improvement is further constrained by the synthetic structural topology.

H Limitation

Node Feature Corruptions. Both the robust graph representation extractor and the adaptive explanation generator are proposed to mitigate and address the graph structural corruptions. Thus, V-InfoR cannot be directly applied to explain the graphs with node feature corruptions. In the future work, we will extend the V-InfoR model to fulfill the robustness on node feature level.

Multi-Task Explanation. The explanation performance of V-InfoR explainer on some other graph tasks, such as node classification and link prediction tasks, has not been evaluated. We argue that V-InfoR can be directly used to explain the GNN predictor on node classification task, with little modification. However, the V-InfoR explainer for link prediction is non-trivial, since the GNN explanation methods on link prediction is scarce until now.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposed a robust GNN explaination method for structurally corrupted graphs. The novelty of the paper is that it considers the noise and corruptions in the graph, and verified that the corruptions can significantly affect the performance of existing GNN explainers. To address this issue, the authors proposed to use variational inference to sample a more robust graph representation and reduce the negative effect of the noise. The authors also formulate the problem as a graph information bottleneck optimization problem. Although straightforward, GIB method can effectively generate the explaination subgraph without any structural constrains, and thus is more general. The evaluations are extensively studied over one synthetic and three real graph datasets. By comparison with current SOTA models, the results show the significant performance improvement of the model in both minor and server corruptions.\nOverall, the paper is very well written and has clear technique contributions. The evaluation is also convincing.\n\nSTRENGTHS:\n(1) The paper studied the GNN explanation problem when the graphs are noisy or corrupted, which is novel and practically important. In real application scenarios, the graphs may contain noise and not reliable, thus it is important to design a more robust explaination model for GNNs.\n(2) The paper considers both mirror and severe corruptions on graph structures. To address the mirror corruptions, a variational inference based robust graph information extractor is proposed. An adaptive graph information constrained is also introduced into the GIB module. The proposed GIB optimization methods can capture both the regularity and irregularity of the corrupted graphs. \n(3) The paper is well written and easy to read. A theoretical analysis is also provided to derive the variational bound of the objective function.\n(4) The experiment is extensively conducted over both real and synthetic datasets. By comparison with current SOTA methods, the performance improvement of V-InfoR is significant.\n\nWEAKNESSES:\n(1) It seems that the robust graph representation extractor can effective filter minor noise. However, it the input graphs do not have minor noise, is this step still required? I wonder if the graph is reliable and do not contain much noise, whether the proposed method still works.\n(2) The paper only considers the structural corruptions on the graphs. The graphs may also contain noise in the attributes. Can the methods be generalized to graphs with attributes corruptions? It would be better that the authors can further discuss how to deal with the attributes noise issue.\n\nQUESTIONS:\n(1) Does the model still work well for the graphs without much structural noise? A comparison between the proposed model and existing models on clean graphs would make the result more convincing.\n(2) Although the authors focus on the structurally corrupted graphs, I still want to see whether the proposed method (like variational node representation) can be easily generalized to the attribute noise and corruptions?\n\nLIMITATIONS:\nLimitations are well discussed in the appendix, and I have no suggestions for improvement.", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe study focuses on the significance of explaining Graph Neural Networks (GNN) models for the development of reliable and trustworthy machine learning systems. Unlike previous research that assumes clean input graphs, this paper introduces a novel approach to constructing a more robust GNN explainer capable of handling graphs with structural corruptions such as noisy and adversarial edges. This is a crucial consideration as real-world graphs are often imperfect. The authors specifically address two scenarios: minor corruptions that do not alter the GNN's prediction results, and severe corruptions that lead to changes in prediction outcomes. To tackle these scenarios, the proposed model, V-InfoR, consists of two modules. The robust graph representation extractor module aims to handle the first scenario, while the graph information bottleneck module focuses on addressing the second scenario. V-InfoR incorporating the two modules can explain well on both the corrupted graphs and the raw graphs. The effectiveness of the proposal is validated through evaluations conducted on four datasets.\n\nSTRENGTHS:\nS1: This paper explores the concept of graph structure corruptions at two different levels and highlights how both levels can negatively impact the quality of GNN explanations. This novel and intriguing study addresses a new and practically significant problem, considering that real-world graphs are susceptible to corruption and attacks.\nS2: The use of variational inference to mitigate the effects of minor corruptions is a logical and robust approach. Additionally, the innovative GIB-based optimization framework effectively tackles the challenge of irregular severe corruptions. The utilization of the graph information bottleneck within the adaptive explanation generator appears to offer a more comprehensive and resilient model compared to existing methods. The integration of these two components allows for simultaneous handling of both types of structure corruptions. Overall, I think the proposed model is well-motivated and demonstrates technical solidity.\nS3: The organization and writing of this paper are easy to follow. The motivation behind the research is also clearly conveyed by providing a preliminary experiment.\nS4: The performance improvement of the proposed model, namely V-InfoR, is holistically verified on four datasets, including both the synthetic and real-world graphs.\n\nWEAKNESSES:\nW1: It is a little confusing that the primary results in experiment are presented and discussed in relation to random noise and adversarial attacks (referred to as adversarial edges in the main text). However, the authors establish definitions for both minor corruptions and severe corruptions. The authors may want to provide a clearer illustration of the relation and distinction between the two categories of corruptions (i.e., in experiment and in definition).\nW2: I find the result presented in Figure 7 somewhat unclear, particularly regarding Figure 7c, where the performance of V-InfoR appears to improve after the graph is corrupted. This raises the question of why V-InfoR demonstrates better performance under such circumstances.\n\nQUESTIONS:\nSome questions are presented in the ‘Weaknesses’. Moreover, do the two terms in the total loss (Eq. (17)), i.e., LVAE and LGIB, need to be combined with a weighted hyper-parameter?\n\nLIMITATIONS:\nThe authors have listed and discussed some potential limitations in the supplementary, including the node feature corruptions and the robust explanation on tasks besides graph classification. I wonder about the explanation efficiency of the proposed model.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-06"}

comments: SUMMARY:
This work aims at structurally corrupted graphs for a more robust explanation. It proposes a method called V-InFoR, which includes two components for minor and severe corruptions respectively. Experiments on synthetic and real data with different corruption ratios verify the effectiveness of the proposal.

STRENGTHS:
1. The motivation is clearly presented by a pre-experiment. And the overall structure of the paper is easy to follow.
2. The two components (VAE and GIB) of the proposed method are not trivial, especially the distribution representation may not be easy to train.
3. The experimental results are convincing, especially those under adversarial attacks.

WEAKNESSES:
1. The authors provide several simulated examples of corruption, which is good. However, they could present more practical examples of corruption in the real world, just at the data level, which could be better for readers to understand the need for robustness.
2. The motivation for the introduction of GIB beyond VAE should be further clarified (lines 180-183), as there is no precise dividing line for minor and severe corruption.

QUESTIONS:
1. Major
    1. In the ablation studies, GIB is more effective in both minor and major corruption cases - any further explanation or intuition behind this phenomenon is welcome.
    2. For the results in Figure 3, further ablation studies of VAE and GIB are recommended.
2. Minor
    1. In Figure 2, the VAE loss should also be noted.

If I have missed anything, please let me know.

LIMITATIONS:
Limitations are included in the appendix.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-06

comments: SUMMARY:
This work introduces a robust GNN explainer for structurally-corrupted graphs. The key idea is to exploit the statistics of the graph's latent distributions insensitive to structural perturbations for reconstructing a new graph that will be further leveraged for subgraph (GNN explainer) identification. Through extensive experiments, the proposed approach is shown to be more robust than existing GNN explainers under strong graph structural perturbations.

STRENGTHS:
1) The idea of using GNNs to extract the graph's latent distributions for graph reconstruction is interesting and effective.
2) The proposed adaptive explanation generator is designed based on a theoretically-sound variational upper bound, which also shows its effectiveness in extensive experimental results.

WEAKNESSES:
1) There should be more discussions of existing works that aim to reconstruct graphs based on properties insensitive to structural perturbations. For example, the graph spectral properties (e.g. the first few Laplacian eigenvalues/eigenvectors) are not sensitive to adversarial attacks and thus can be leveraged for graph reconstruction (see a recent work "GARNET: Reduced-Rank Topology Learning for Robust and Scalable Graph Neural Networks" published in LoG'22).
2) There should be a section discussing the algorithm runtime/space complexity of the proposed framework. It is not clear if this method can be efficiently applied to large graphs.

QUESTIONS:
The statistical metrics mean and deviation is considered for extracting the latent distribution. Will other higher-order statistical metrics help in this step?

LIMITATIONS:
There should be a section discussing the runtime/space complexity of the proposed method. Additional runtime results should also be reported for graphs with different sizes.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-07

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a method of explaining GNNs when the input graph is noisy. Existing methods tend to misexplain when noisy graphs are given. The proposed method uses GraphVAE to remove minor noise from the input graph, and a formulation with information bottlenecks allows detecting the presence of severe noise. Experiments confirm the effectiveness of the proposed method using one artificial and three real datasets.\n\nSTRENGTHS:\n- This paper is the first to propose a GNN explanation method in noisy settings. This problem setting seems important in practice.\n- The proposed method consistently outperforms existing methods in the experiments.\n\nWEAKNESSES:\n- I was not convinced that the GIB loss is particularly effective in noisy situations, although it is indeed a plausible explanation. More detailed discussions are required.\n- Figure 3 shows that the proposed method outperforms the existing methods by the same amount in the absence of noise and in the presence of noise, and when noise is added, the accuracy drops at the same rate as the existing methods. The reason the proposed method outperforms the existing method may not be because it is robust to noise, but simply because it is more accurate. High accuracy is great, but given the subject of this work, which focuses on noise, it is not aligned with the main claim.\n- The proposed method is too complex for practical use. I would not want to use this as a practitioner.\n- The experiment only uses GRABNEL as severe noise. Although the authors state that GRABNEL is the attack method of SoTA, there are many aspects of the attack, and defense against only GRABNE is not sufficient. It would be better to use more attack methods, including basic ones such as nettack and metattack.\n- The method section is messy. It would be helpful to summarize a list of parameters to be optimized at the end.\n\nQUESTIONS:\n- Could you provide an intuitive explanation on why the GIB loss is robust with respect to severe noise?\n- Based on the trends in Figure 3, the proposed method may not be robust to noise, but simply accurate. Could you show that the proposed method is indeed robust to noise?\n\nLIMITATIONS:\nPotential negative societal impacts do not apply.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-18"}