Title: Robust Graph Condensation via Classification Complexity Mitigation
Venue: NeurIPS 2025
Accepted: yes
Keywords: Graph Dataset Condensation

Robust Graph Learning
Abstract: Graph condensation (GC) has gained significant attention for its ability to synthesize smaller yet informative graphs. However, existing studies often overlook the robustness of GC in scenarios where the original graph is corrupted. In such cases, we observe that the performance of GC deteriorates significantly, while existing robust graph learning technologies offer only limited effectiveness. Through both empirical investigation and theoretical analysis, we reveal that GC is inherently an intrinsic-dimension-reducing process, synthesizing a condensed graph with lower classification complexity. Although this property is critical for effective GC performance, it remains highly vulnerable to adversarial perturbations. 
To tackle this vulnerability and improve GC robustness, we adopt the geometry perspective of graph data manifold and propose a novel **M**anifold-constrained **R**obust **G**raph **C**ondensation framework named **MRGC**. Specifically, we introduce three graph data manifold learning modules that guide the condensed graph to lie within a smooth, low-dimensional manifold with minimal class ambiguity, thereby preserving the classification complexity reduction capability of GC and ensuring robust performance under universal adversarial attacks. Extensive experiments demonstrate the robustness of MRGC across diverse attack scenarios.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces MRGC, a manifold-constrained robust graph-condensation framework. By combining theoretical insights into intrinsic dimension reduction with three complementary manifold learning modules and extensive benchmarking, the study tackles the largely unexplored problem of making graph condensation resilient to attacks.\n\nSTRENGTHS AND WEAKNESSES:\n**Pros**\n1. This paper aims to address a cutting-edge problem.\n2. The figures in this paper are visually appealing and well-designed.\n\n**Cons**  \n1. At lines 130 and onwards, Theorem 2 lacks a precise definition of “graph under attack”; both the attacker’s capabilities and objectives remain unspecified, and no threat model is provided.  \n2. In the proof of Theorem 2 (around line 525), the inequality $P(g_{\\Phi_{*}'}(n_c)) < P(g_{\\Phi'}(n_c))$ violates probability axioms and its derivation from Assumption 4 is unclear.  \n3. The use of Corollary 6 from reference [54] (manuscript Eq. 17) is stretched: the corollary is valid only for linear classifiers, yet the manuscript applies it directly to general graph learning models without justification; citing [51] for Assumption 2 does not fix this gap because [51] is unrelated to graph learning.  \n4. Because Theorem 2 rests on Theorem 1, and Theorem 1 depends on assumptions of doubtful realism, the entire theoretical foundation of MRGC may be fragile.  \n5. Even assuming Theorem 2 is correct, the key motivation on lines 133 and 134 “protecting the key ID decreasing characteristic of GC” is insufficiently dialectical; malicious actors could perform adaptive attacks that deliberately seek condensation schemes with lower ID.  \n6. The practical need for full manifold metrics is debatable: intrinsic dimension is helpful, but introducing curvature and class overlap terms makes the pipeline complex; the manuscript gives no evidence that simpler surrogate measures would fail.  \n7. Equation 22 overruns the page margin, violating layout guidelines.  \n8. The proposed pipeline is difficult to deploy in practice; aside from the ID estimation module, the necessity of the curvature and decoupling components is not convincingly motivated.  \n\n**Justification for the rating**\nThe robustness of graph condensation is indeed a highly cutting-edge research topic, and NeurIPS, as one of the most prominent conferences, should actively embrace contributions in this direction. However, this paper presents several critical and unavoidable issues. The theoretical foundation is not sufficiently solid, and the complex pipeline introduced lacks adequate motivation. Among the three core components, only the first one that computes the intrinsic dimension appears necessary, while the other two lack justification. In practice, it would be very difficult to deploy such a complex method. Based on these observations, the overall contribution remains limited.\n\nQUESTIONS:\n1. I would like to ask for a clearer explanation of the assumptions behind Theorem 1. Could the authors provide empirical or theoretical evidence showing that these assumptions hold in real-world graph condensation scenarios?  \n2. The validity of Theorem 2 relies on both Theorem 1 and Assumption 4. I am not fully convinced by the logical connection in the proof. Could the authors walk through how exactly the conclusion follows from the assumptions, especially in light of the probability inconsistency mentioned in the proof?  \n3. I find it difficult to see how Corollary 6 from [54], which is based on linear classifiers, can be directly extended to general graph learning models. Could the authors clarify why this is justified and whether there are any intermediate theoretical results supporting this leap?  \n4. I appreciate the authors’ effort in connecting graph condensation with intrinsic dimension. However, I wonder whether introducing manifold metrics like curvature and class overlap is truly necessary. Have the authors considered whether simpler alternatives could be similarly effective?  \n5. The full pipeline seems overly complex for practical deployment. Have the authors conducted experiments to isolate the contribution of each module? I would like to know if the curvature and decoupling modules are strictly necessary beyond the ID module.  \n6. The motivation for introducing manifold constraints appears theoretical. Could the authors offer more practical insights or empirical observations to support the decision to use all three manifold metrics?\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-23"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a new framework for Robust Graph Condensation that enhances the resilience of GNNs trained on condensed graphs under adversarial or noisy perturbations. The core idea is to regularize the classification complexity during the condensation process, encouraging the model to favor simple and generalizable decision boundaries. The method shows improved performance and robustness on various datasets compared to existing condensation and defense baselines.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths:**\n1. The paper identifies a clear limitation in prior condensation methods of overfitting to clean signals, which leads to fragile synthetic graphs.\n2. Instead of modifying the GNN or defenses post hoc, the method improves robustness through simple decision boundary enforcement during condensation.\n3. Empirical results show consistent robustness gains across different noise levels and attacks (random, adversarial, feature corruption).\n\n**Weaknesses:**\n1. On unperturbed graphs, MRGC does not always outperform baseline condensation methods (e.g., GCOND), and occasionally performs worse (Table 1), raising concerns about trade-offs.\n2. Classifier complexity measure is heuristic. While the entropy-margin loss is intuitive, there’s no formal link to generalization bounds or complexity measures from theory (e.g., VC-dim, Rademacher complexity).\n3. No analysis of why existing robust GNNs fail. The paper does not offer empirical or theoretical analysis of why prior defenses (e.g., Pro-GNN, R-GCN) underperform in graph condensation settings.\n\nQUESTIONS:\n1. Most robust GNNs rely on full-graph structures and global supervision, which are absent in the condensed setting. How do these mismatches lead to their ineffectiveness when applied post-condensation?\n2. In what way does constraining the classifier to simpler decision boundaries improve generalization and resistance to perturbations on synthetic graphs?\n3. Does the added regularization introduce any trade-offs in clean accuracy, and how does the method compare to baseline condensation approaches without perturbation?\n4. For other questions, please refer to the Weaknesses.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nCurrent Graph Condensation (GC) algorithms struggle to handle noisy data effectively and lack sufficient robustness studies. This paper aims to address the following three key questions: \\\nQ1: Can existing robust graph learning techniques enhance the robustness of GC methods? \\\nQ2: What key property of GC is disrupted by adversarial attacks, leading to performance degradation, and can this be theoretically explained? \\\nQ3: How can we design an effective defense strategy to counter universal attacks in GC?\n\nThey use three metrics to measure classification complexity, along with the analysis of the relationship between graph condensation (GC) and adversarial attacks.\n\nTo address the robustness issues in current GC methods, the paper proposes three key components: Manifold Regularization, Curvature-Aware Manifold Smoothing, and Class-Wise Manifold Decoupling.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- The use of three metrics to measure classification complexity, along with the analysis of the relationship between graph condensation (GC) and adversarial attacks, makes the motivation of this paper easy to understand. It also provides an intuitive explanation of the limitations of current GC algorithms.\n- The motivation of the paper is clearly presented, and the introduction is easy to follow.\n- The overall writing is logically structured and accessible, allowing readers to understand the contributions even without deep familiarity with the underlying theory.\n- The experimental evaluation is thorough and comprehensive.\n\nWeaknesses:\n1. In Figure 1.C, it would be more informative to show how the three metrics change on the original graph before and after the attack. Comparing only the condensed graph under clean and attacked conditions can demonstrate that the attack degrades accuracy or increases classification difficulty, but it is insufficient to evaluate how well GC performs on the attacked input graph itself.\n2. Section 3.2 aims to produce clearer decision boundaries through Curvature-Aware Manifold Smoothing. In that case, is the additional method in Section 3.3 necessary? The potential redundancy between the two is unclear.\n3. The concept of the manifold M(G′)\\mathcal{M}(G')M(G′) plays a central role in the proposed method. However, its definition and the specific type of manifold used remain unclear. A more precise explanation or formal definition would help clarify the intuition and theoretical foundation of the approach.\n4. In Tables 1 and 2, under different attack strategies and settings, it would be helpful to include the performance without condensation as a reference. This would allow readers to better understand the effectiveness of GC under various conditions. Additionally, I suggest clearly marking the performance on the original graph in the tables for easier comparison.\n5. The discussion on limitations is insufficient. As the authors, you likely have a deep understanding of the potential weaknesses of your approach. A more thorough and reasonable analysis of the limitations would help readers better assess the scope and applicability of your work.\n\nQUESTIONS:\nSee weaknesses\n\nLIMITATIONS:\nThe discussion on limitations is insufficient. As the authors, you likely have a deep understanding of the potential weaknesses of your approach. A more thorough and reasonable analysis of the limitations would help readers better assess the scope and applicability of your work.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces Manifold-constrained Robust Graph Condensation (MRGC), a novel framework designed to enhance the robustness of Graph Condensation (GC) against universal adversarial attacks on graph features, structures, and labels. The authors empirically and theoretically demonstrate that GC inherently reduces the classification complexity of graphs, a critical property that is highly vulnerable to adversarial perturbations. To counter this vulnerability, MRGC incorporates three graph data manifold learning modules: Intrinsic Dimension Manifold Regularization, Curvature-Aware Manifold Smoothing, and Class-Wise Manifold Decoupling. These modules guide the condensed graph to reside within a smooth, low-dimensional manifold with minimal class ambiguity, thereby preserving GC's classification complexity reduction capability and ensuring robust performance against diverse attack scenarios. Extensive experiments show that MRGC consistently outperforms existing baselines across various datasets and attack budgets\n\nSTRENGTHS AND WEAKNESSES:\n**Strength:**\n- Novelty in Robustness: The paper addresses a largely unexplored area: the robustness of Graph Condensation (GC) against various adversarial attacks (feature, structure, and label perturbations).\n\n- Clear presentation of the designed modules.\n\n- Comprehensive analysis and experimentation: It provides both empirical investigation and theoretical analysis to reveal that GC is an intrinsic-dimension-reducing process, and this property is vulnerable to adversarial attacks.\n\n- Demonstrated Superior Performance: Extensive experiments show that MRGC consistently outperforms state-of-the-art GC methods and robust graph denoising techniques across various datasets and attack budgets.\n\n- It is appreciated that the author conducts the ablation study on the MRGC performance by removing each module.\n\nQUESTIONS:\n- The experiments evaluate robustness against specific and commonly used poisoning attacks: PRBCD for structure, random feature sampling, and uniform label flipping. I am not confidence on the attack performance of random feature sampling and uniform label flipping. I am curious will the resilience still hold after being attacked by more dedicated attack methods like like Nettack[1]. \n\n[1] Zügner, Daniel, Amir Akbarnejad, and Stephan Günnemann. \"Adversarial attacks on neural networks for graph data.\" Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining. 2018.\n\nLIMITATIONS:\n**Scope of Adversarial Attacks:** The experiments evaluate robustness against specific and commonly used poisoning attacks: PRBCD for structure, random feature sampling, and uniform label flipping. The study does not investigate the method's resilience against a broader range of more sophisticated or adaptive adversarial attacks.\n\n**Hyperparameter Tuning:** The MRGC framework introduces three new regularization hyperparameters (α,β,γ) which must be tuned. The paper notes that these were determined through a grid search, which can be a computationally intensive process and may pose a practical challenge for applying the method to new datasets.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}