Paper:
Deep neural networks on graph structured data have shown increasing success in various applications. However, due to recent studies about vulnerabilities of machine learning models, researchers are encouraged to explore the robustness of graph neural networks (GNNs). So far there are two works targeting to attack GNNs by adding/deleting edges to fool graph based classification tasks. Such attacks are challenging to be detected since the manipulation is very subtle compared with traditional graph attacks. In this paper we propose the first detection mechanism against these two proposed attacks. Given a perturbed graph, we propose novel graph generation method together with link prediction as preprocessing to detect potential malicious edges. We also propose novel features which can be leveraged to perform outlier detection when the number of added malicious edges are large. Different detection components are proposed and tested, and we also evaluate the performance of the final detection pipeline. Extensive experiments are conducted to show that the proposed detection mechanism can achieve AUC above 90% against the two attack strategies on both Cora and Citeseer datasets. We also provide in-depth analysis for different attack strategies and corresponding suitable detection methods. Our results shed light on several principles for detecting different types of attacks.

Review:
The authors address the interesting problem about the attack on the graph convolutional network model. The proposed method is developed under the assumptions about the attacking models sound simple but reasonable with proper references.  
However, the proposed approaches mostly include the ideas about the detecting mechanisms instead of being formulated in some novel form. Given that the proposed algorithms do not leverage the underlying model structure very much, why the proposed algorithms are special to the graphical neural network is not very clear.
Also, the evaluations need to be further improved. It seems that victim nodes are carefully selected and fixed throughout all the experiments, but it limits the generalization about the performance of the proposed algorithms. Particularly, since the different detection algorithms perform differently on different datasets, more extensive evaluations are required along with the guideline of what detection algorithm we have to choose for the unsupervised setting.
*Details
- It will be great if the authors clearly describe what the proposed methods aim to defend. Basically, the values by protecting some victim nodes, regardless of what attacking models are assumed, will help the audience with better understanding. Some of content in Section 2.2 can be brought up in the introduction.
- In Section 3.1 and some other subsections, it seems to assume that the links in a given network are very clean but in reality there are a lot of noisy connections. How can we distinguish some random connections from malicious connections? Evaluation along with this question will be also useful.
- In Section 3.2, eventually, the ratio of malicious edges remains the same if the authors use random sampling. In that case, how SubGraphLinkPred helps is not very convincing.
- The detection algorithm seems to exist to detect malicious edges without supervision. In that case, how can we determine which method we should use given that detection performance differs in different dataset?
- It would be useful to compare with some existing malicious node/graph pattern mining algorithms such as Graph-Based Fraud Detection in the Face of Camouflage, Hooi et. al. even if the baseline method does not aim to directly solve the addressed problem. And also that literature needs to be cited.