Paper: PROSPECT: Learn MLPs Robust against Graph Adversarial Structure Attacks (ICLR-2024)

Reviewer comment (Experiments):
**About Motivation.** The most concern of mine is that the improvement with respect to robustness and performance under heterophily results from the introduction of distillation but not the proposed PROSPECT. Based on the analysis, any GNN-MLP distillation framework seems to surpass a single GNN in the two fields. While the advantage of PROSPECT over previous distillation methods regarding clean accuracy is slightly discussed on page 4, how PROSPECT excels against attacks and heterophily is unclear.

Author response:
* ***The benefits of GNN-to-MLP distillation.***

Prior works, e.g., GLNN,first train a GNN teacher, then the GNN-to-MLP direction distillation is leveraged to transfer the knowledge from a pretrained GNN to a student MLP for fast inference. As shown by the clean accuracy results in Table 2, GLNN (i.e., GNN-to-MLP distillation)  cannot consistently improve the teacher SAGE (on heterophilic graphs) but succeeds in boosting the student MLP.  That is **GNN-to-MLP distillation is important to get a decent MLP w.r.t. clean accuracy.** The observation 2 in Appendix G.2.2 have revealed that GLNN often exceeds an alone SAGE teacher w.r.t. adversarial robustness, meaning that **GNN-to-MLP distillation can sometimes slightly mitigate the poisoning attacks.**

* ***PROSPECT incorporates both GNN-to-MLP and MLP-to-GNN distillation.***

Our PROSPECT simultaneously performs both GNN-to-MLP direction distillation and MLP-to-GNN direction distillation to jointly learn decent GNN and MLP. While the benefits of GNN-to-MLP distillation are shown by the above discussion, the benefits of MLP-to-GNN distillation is supported by Theorem 1. The goal of PROSPECT is to merge the knowledge from both MLP and GNN sides via these two distillation directions. Such knowledge fusion brings about desired effects, such as the robustness and adaptability to heterophily.

* ***How PROSPECT excels GLNN and SAGE against (structure) attacks?*** Substantially by MLP-to-GNN distillation.

  As stated by the paragraph between Remark1 and Remark2 (at p.5) and discussed by Observation 3 in Appendix G.2.2, the Prospect Condition is usually met for node $i$ under successful structure attacks that drastically degrade the SAGE performance but have no influence on the MLP due to its independence to graph structure. 

  One thing worth noting is that for the attacked node $i$, the MLP does NOT need to correctly classify it to be a good teacher because any successful structure attacks can always significantly decrease the SAGE classificaiton score on the ground-truth class $c$ of node $i$ such that even an MLP can output a higher score on class $c$. This makes the defense mechanism of PROSPECT more applicable.

* ***How PROSPECT excels GLNN and SAGE against heterophily?*** By mutual distillation.

  On one hand, as shown by Table 2 (at p.8), MLP can have decent performance on heterophilous graphs. On Texas and UAI, MLP even outperforms SAGE, meaning that MLP has some useful information to exploit. On the other hand, given their respective emphases on node attributes and topological structures, MLPs and GNNs are very likely to exhibit divergence in their correct prediction test sets V_{mlp} and  V_{gnn}.  So the union of these two sets (i.e., the knowledge fusion of MLP and GNN) V_{union} could lead to a larger correct prediction set than alone MLP or alone GNN. We have observed this phenomena across all clean and attacked (LLC) datasets used in the paper. Owing to the space limit, we only show the case on clean datasets in **Table A**. With the offline procedure, the SAGE teacher in GLNN can never acquire the knowledge from MLP. In contrast, the mutual disitllation mechanism of PROSPECT makes it possible to merge the knowledge from both GNN and MLP sides, and this is why PROSPECT excels alone MLP/SAGE and GLNN in clean (heterophily)  accuracy.

According to the above analysis, the improvement of PROSPECT over GLNN (solely based on GNN-to-MLP distillation) and alone GNN results from the introduction of the neglected MLP-to-GNN distillation and the knowledge fusion achieved through mutual interaction.


**Table A**: Test Acc. (%) on the correct test sets of MLP and GNN, and the union correct set, with seed=15
|                       | cora  | citeseer | polblogs | acm   | cora_ml | texas | chameleon | uai   |
| --------------------- | ----- | -------- | -------- | ----- | ------- | ----- | --------- | ----- |
| $\mathcal{V}_{gnn}$   | 83.40 | 73.76    | 95.71    | 91.65 | 84.43   | 68.71 | 54.50     | 63.24 |
| $\mathcal{V}_{mlp}$   | 62.78 | 66.23    | 52.04    | 85.91 | 68.42   | 68.03 | 40.23     | 65.04 |
| $\mathcal{V}_{union}$ | 87.42 | 80.04    | 97.44    | 95.99 | 89.01   | 78.23 | 64.60     | 71.96 |

Reviewer comment (Experiments):
**Number of Hyperparams.** The whole framework, together with the scheduler, includes quite a few hyperparameters compared to the baselines. It would be a concern if the hyperparameters varied a lot between different datasets. Also, if the performance is highly affected by the hyperparameters.

Author response:
**Weakness 2**: Number of Hyperparams.

* ***The hyperparameters of PROSPECT:*** The hyperparameters introduced by PROSPECT include the loss weights for the logit distillation terms of the individual MLP and GNN optimization objectives, and the knowledge distillation temperatures of them. These are inevitable hyperparameters present in all mutual distillation architectures.

* ***The hyperparameters of QACA:*** Although QACA contains hyperparameters including individual learning rates, weight decay values, minimum optimization cycle, and minimum learning rates of MLP and GNN, only the last three hyperparameters are actually introduced by the QACA scheduler. The other hyperparameters are originally present in the individual MLP and GNN models themselves.

* ***Why these hyperparameters?*** **1)** The differences in these hyperparameters across datasets are primarily to accommodate the behaviour differences between the MLP and GNN on datasets with different characteristics (see **Table A** for a glance). How to design mutual distillation schemes between GNNs and MLPs that can self-adapt to different dataset characteristics is an important future research direction that would require a series of complete independent studies to elaborate (we are working on such a project). Adding this would make this already lengthy paper even more complex and diffuse in focus.

Reviewer comment (Experiments):
**Baseline Missing.** A robust defense model that also tackles heterophily is not included. It would be better to have a comparison to it. [1] Deng, Chenhui, et al. "GARNET: Reduced-Rank Topology Learning for Robust and Scalable Graph Neural Networks." Learning on Graphs Conference. PMLR, 2022.

Author response:
**Weakness 3**: Baseline Missing.

We have supplemented many experiments, including the comprehensive comparison between GPRGNN [1], GARNET [2] and our PROSPECT under 4 other attacks in addition to Metattack. Please refer to the **Appended Experiments** section of joint response above for details.

Reviewer comment (Reproducibility):
**Presentation.** The current version is not friendly to those unfamiliar with distillation and graph adversarial attacks. It would be better if more details about distillation (like the online/offline settings) and a pseudo-code of PROSPECT were offered.

Author response:
**Weakness 4**: Presentation.

* ***More details about graph distillation***
  We can only add an introduction about offline and online graph distillation models to the appendix due to the length limit of main text.
* ***A pseudo-code***
  By aggregating the losses of the MLP and GNN components to derive an overall loss term loss, then invoking loss.backward(), the PROSPECT training procedure resembles optimizing a solitary model, except that the MLP and GNN each have their own optimizers and QACA scheduler. If the reviewer feels necessary, we can add a pseudocode in the appendix.

Reviewer comment (Evaluation):
**Training time.** While the framework shows the desirable inference efficiency, what about its training time?

Author response:
**Question 1**: Training time.
The MLP, GCN and SAGE can be formulated as $H=XW$, $H=AXW$ and $H=XW_1+AXW_2$  , respectively. And the basic operations to build them are  $Z=WX$ and $H=AZ$. Han et al. [3] have reported the forward and backward time of these two basic operations on serveral graphs. We extracte the data on Arxiv from the time comparison Tabel 1 in [3] into **Table B** below. According to the snippet, we can roughly estimate the training time of PROSPECT (that comprises one SAGE and one MLP), which shows that the additional training overhead incurred by PROSPECT over SAGE is almost negligible.
Moreover, in the supplemented GR-BCD attack experiments on Arxiv (see the joint response), we report the training times of PROSPECT and GARNET. These results show that the training overhead of PROSPECT is almost the same as using GCN alone, and much lower than GARNET.

**Table B**: Forward and backward times (ms). The first two rows are from Table 1 of [3], and the last two rows are the estimations based on the first rows.
| Operation | Forward | Backward | Total   |
| --------- | ------- | -------- | ------- |
| $Z=WX$    | 0.32    | 1.09     | 1.42    |
| $H=AZ$    | 1.09    | 1028.08  | 1029.17 |
| SAGE      | 1.73    | 1030.26  | 1032.01 |
| PROSPECT  | 2.05    | 1031.35  | 1033.43 |

Reviewer comment (Experiments):
**About Figure 1.** It is good to see that the proposed QACA works through the ablation study in Figure 1. However, the fixed version seems noncompetitive against other defense baselines. Is the QACA scheduler the one that actually contributes to the performance? Can the previous distillation methods be enhanced by QACA as well?

Author response:
**Question 2**: About Figure 1.

* ***"However, the fixed version seems noncompetitive against other defense baselines. "***
  As discussed in the **Contributions/The key to future mutual distillation** section of joint response, simply combining GNNs and MLPs for mutual distillation may easily lead to failure because of the model heterogeneity issue identified and (partially) solved by us.

* ***"Is the QACA scheduler the one that actually contributes to the performance?"***
  **1)** As discussed in **Weakness 1**, GNN-to-MLP and MLP-to-GNN distillation, i.e., the interaction between GNN and MLP contributes to the clean accuracy and robustness due to the accumulated knowledge post knowledge fusion (through mutual distillation). This gain has nothing to do with a specific optimization method. **2)** However, as pointed out in the **Contributions/The key to future mutual distillation** section of joint response, simply combining GNN and MLP can lead to failure and that's why we need a QACA optimization paradigm. **3)** In short, we think that the PROSPECT framework itself determines its capability, but this capability is locked. And QACA is just the key that opens the lock.*
* ***"Can the previous distillation methods be enhanced by QACA as well?"***
  **1)** QACA addresses underlying knowledge discrepancies within heterogeneous model distillation, hence offline frameworks, e.g.,GLNN, do not stand to benefit. Potentially, QACA mitigates conflicts even for general heterogeneous mutual distillation, but space constraints precluded detailed analysis beyond GNN-MLP. **2)** As pioneering GNN-MLP mutual distillation research, this paper validates QACA efficacy for this task. Intuitively, distilling between similar models unlikely exhibits severe conflicts, limiting QACA’s boons for GNN-GNN. However, QACA could assist future GNN-GNN models incorporating knowledge conflicts.

Reviewer comment (Experiments):
Missing relevant defense models for evaluation. Authors mentioned that prior purification methods are computationally expensive and restricted to homophilous graphs. However, there are some recent studies (e.g., [1]) that have addressed these limitations. It would largely improve the paper to include comparisons against proper baselines.

Author response:
We thank the reviewer for the reminder and add GPRGNN [1] GARNET [2] baselines. GARNET is indeed the master of current graph purification methods, but its scalability is limited by the (truncated) SVD decomposition and is weaker than PROSPECT, as shown by the supplementary experiments (see Section **Appended Experiments/Arxiv attacked by GR-BCD** of the joint reponse).

Reviewer comment (Reproducibility):
Missing detailed hyperparameter settings for baselines. Note that many defense methods (e.g., ProGNN) require decent hyperparameter tuning to achieve their best performance. It is unclear whether authors put in enough efforts on tuning those baselines.

Author response:
Initially, we observed inconsistencies in current pre-attacked dataset creation paradigms. Specifically, certain works only utilize a sole train/validation/test split, risking less comprehensive evaluations. Hence, we strived to construct over 10 pre-attacked datasets under 4 attack budgets and 5 splits. During baseline hyperparameter tuning however, even abiding by original author guidelines, optimizing across the 5 splits proved challenging for some methods. We are benchmarking existing robust GNN techniques, tuning their hyperparameters accordingly, and will update performances if improvements emerge. Moreover, the diverse pre-processed attack datasets alongside all benchmark outcomes will be publicly disclosed in future endeavors.

Reviewer comment (Experiments):
Claim 3 is too strong. Given that PROSPECT is only integrated with GraphSAGE in this work, it is improper to claim PROSPECT can boost clean accuracy of GNNs, unless authors conduct more experiments with different GNNs integrated into PROSPECT.

Author response:
Thanks for pointing this out, we've narrowed the claims in Claim 3 (now renamed to Remark 3) to SAGE.

Reviewer comment (Experiments):
It does not seem reasonable to adopt GCN as the surrogate model for MetaAttack on heterophilous datasets. Why didn't the authors choose heterophilous GNNs as the surrogate model?

Author response:
We also agree with that heterophilous GNNs seems more reasonable, but for the following reasons, we have temporarily compromised. **1)** We found that GCN, as a surrogate for heterophilic data, can actually produce effective attacks, so this does not prevent the evaluation of the defense model. **2)** Attacking under the unified agent model, namely GCN, can provide a reference benchmark for exploring attack and defense on heterophilic graphs. **3)** the MetaAttack and Nettack implementations from current tools, e.g., DeepRobust [5], do not support flexible proxy model settings.

Reviewer comment (Reproducibility):
Are baseline models trained with cosine annealing learning rate scheduler?

Author response:
The baseline models are not trained with cosine annealing. 
The performance improvement of PROSPECT mainly comes from the knowledge fusion of GNN and MLP sides. QACA works by solving the knowledge conflict problem in the fusion process but it never brings additional knowledge to one alone GNN or MLP. That is, training SAGE and MLP individually with cosine annealing does not bring additional knowledge and thus is not necessary.

Reviewer comment (Experiments):
The empirical examination of PROSPECT's robustness against a specific untargeted poisoning attack, Metattack, is commendable. However, it could potentially enhance its persuasiveness by extending the experiment to include targeted attack scenarios and additional untargeted attack methods, such as GraD.

Author response:
**Question 1**: More attack scenarios.

Following your suggestion, we have evaluated PROSPECT with 4 other kinds of attacks [1,2,3,4], including both untargeted and targeted ones. (The details of these new experiments are provided in Section **Appended Experiments** of the joint response.)

[1] D. Zügner, A. Akbarnejad, and S. Günnemann, “Adversarial Attacks on Neural Networks for Graph Data,” KDD'2018.

[2] M. Ju, Y. Fan, C. Zhang, and Y. Ye, “Let Graph Be the Go Board: Gradient-Free Node Injection Attack for Graph Neural Networks via Reinforcement Learning,” AAAI'2023.

[3] F. Mujkanovic, S. Geisler, S. Günnemann, and A. Bojchevski, “Are Defenses for Graph Neural Networks Robust?,” NeurIPS'2023.

[4] S. Geisler, et al., “Robustness of Graph Neural Networks at Scale,” NeurIPS'2021.

Reviewer comment (Theory):
The paper is full of overstating claims like "Theorem 1 implies the adversarial robustness of Prospect". While Theorem 1 might imply robustness on cSBMs, it is merely conjectured that this robustness extrapolates to real-world graphs.

Author response:
**Weakness 1**: Overstating claims.

We apologize that there were overstated claims in our original manuscript. We have re-examined the paper, eliminating overstated claims. We understand the importance of avoiding overstatements in academic writing, and your feedback has helped us improve the manuscript in this regard. Please let us know if there are any remaining issues with overclaiming and we will be happy to address them.

Reviewer comment (Experiments):
Poisoning defense heavily uses the restricted threat model to solely perturb the graph structure and not the node features. It is one thing to follow the many other works in this simplifying assumption that focuses on the distinct characteristics of the robustness of GNNs; however, exploiting the clean node features seems highly questionable. The authors should discuss this and evaluate w.r.t., e.g., a joint attack on the graph structure and node features.

Author response:
**Weakness 2**: “The authors should discuss this and evaluate w.r.t., e.g., a joint attack on the graph structure and node features.”

Please refer to the discussion section **Concerns about joint, injection and adaptive attacks** in the joint response.

Reviewer comment (Evaluation):
The empirical evaluation is insufficient: The authors solely evaluate using a non-adaptive transfer attack. As pointed out previously, it is vital to assess neural networks with adaptive attacks [C, D] to get a proper estimate of the model's robustness.

Author response:
**Weakness 3**: “The empirical evaluation is insufficient.”

We explained in the **Concerns about joint, injection and adaptive attacks/Adaptive attacks** section of joint response why the test with an adaptive attack is not performed at the first place. Due to the adaption issue pointed out here and urgent discussion deadline, we can only conduct part of black box unit tests provided by [A]. The experiment results can found in Section **Appended Experiments** of the joint response.

Reviewer comment (Experiments):
The authors claim scalability. Thus, they should compare to other works using large graphs [A, B].

Author response:
**Weakness 4**: “The authors claim scalability. Thus, they should compare to other works using large graphs.”

Although we have made every effort to supplement all experiments, time and computational constraints prevent us from conducting experiments on data beyond the pre-made large-scale perturbation datasets. We are so sorry that we only directly adopt the pre-attacked arxiv dataset from [C] and did not make pre-attacked datasets with the method from [B]. Nonetheless, we believe it is necessary to briefly introduce [B] in our paper.

Reviewer comment (Experiments):
Just because an MLP is robust w.r.t. structure perturbations does not imply it is useful. Moreover, there might be an interaction between the GNN and MLP. If the authors make a claim about evasion (e.g. second last line of page 3), they should also verify that empirically.

Author response:
**Weakness 5.1**: “Just because an MLP is robust w.r.t. structure perturbations does not imply it is useful. Moreover, there might be an interaction between the GNN and MLP.”

You did capture the key point of PROSPECT - the naive interactive behavior resulted from simply combining GNN and MLP for mutual distillation will cause the mutual distillation between these two types of heterogeneous models to fail, as stressed out in the **Contributions/The key to future mutual distillation** section of joint response.

However, it should be noted that the performance gain of PROSPECT mainly comes from the fusion of the respective knowledge of GNN and MLP (regardless of attack or clean scenarios), so its theoretical performance has nothing to do with a specific optimization method like QACA. 

We think that the knowledge conflict caused by the model heterogeneity locks the performance of PROSPECT, and QACA is just the key to this lock.

**Weakness 5.2**: “If the authors make a claim about evasion (e.g. second last line of page 3), they should also verify that empirically.”

We apologize for misleading you with the imprecise statement on page 3. In fact, we want to say that PROSPECT-MLP trained by the PROSPECT framework does not require graph structure for inference, so it is completely robust to (structure) evasion attacks. Considering that both Prospect-MLP and Prospect-SAGE can be deployed for inference, we attribute this property to the PROSPECT framework.

By the way, the performance of PROSPECT-MLP under evasion structure attacks is actually the same as that in the clean accuracy table, i.e., Table 2 of our paper.

Reviewer comment (Presentation):
The presentation of the Theorems in the main part could be improved. It is unclear how the reader should deduce Theorem 1 from Proposition 1&2. Perhaps it would be better to move the propositions to the appendix and instead add a proof sketch to the main part.

Author response:
**Weakness 6**:"The presentation of the Theorems in the main part could be improved. It is unclear how the reader should deduce Theorem 1 from Proposition 1&2. Perhaps it would be better to move the propositions to the appendix and instead add a proof sketch to the main part."

We are very sorry that we did not add proof schetch due to page limit. However, we are happy to add a proof sketch summarizing the high-level approach before formally proving Theorem 1, if you think this would further enhance the presentation.

We give the main proof schetch of Theorem 1 and point out how Prop.1 and Prop.2 relate to the proof below.

1. Prop. 1 gives the distribution of processed features  $\mathbf{h}$ obtained by feeding the CSBM raw data to a SAGE layer.
2. Prop. 2 gives the ideal optimal decision boundary of the processed featuress $\mathbf{h}$.
3. Based on the gradients of the cross-entropy and KLD losses w.r.t. the SAGE layer parameters, we can get different SAGE weights that output different processed features with and without MLP-to-GNN distillation, denoted by $\mathbf{h}^{kd}$ and $\mathbf{h}$, respectively. In this process, the conclusion of Prop. 1 and some other auxiliary propositons in the appendix are required.
4. Per Prop.2, the optimal decision boundaries of $\mathbf{h}^{kd}$ and $\mathbf{h}$ can be derived. Then we comapre the (expected) distances of $\mathbf{h}_i^{kd}$ and $\mathbf{h}_i$ from their respective optimal decision boundaries (i.e., the mis-classified probabilities).
5. Prove that $\mathbf{h}_i^{kd}$ is more far away from the optimal decision boundary of  $\mathbf{h}^{kd}$. And thus the distillation is helpful to SAGE.

As cSBM may be unfamiliar to some readers, keeping the propositions provides context about the data characteristics right before Theorem 1. So perhaps we should keep them before Theorem 1 in the main text. How do you think?

Reviewer comment (Theory):
Could the theory be extended to further data-generating distributions like Barabasi–Albert? [E]

Author response:
**Question 2**: "Could the theory be extended to further data-generating distributions like Barabasi–Albert?"

We examined the Barabasi–Albert data-generating distribution described in [D]. The biggest difference from the graph data generator used in our paper is probably that it does not contain node features, whereas Theorem 1 illustrates the benefits of MLP-to-GNN distillation by examining the distance between node features and the optimal decision boundary. Therefore, it cannot be directly generalized to the data generator you mentioned. Nevertheless, we guess that treating the category probability distribution of each node as its node feature may yield some interesting results with the Barabasi–Albert data-generating distribution.

By the way, the key to generalizing Theorem 1 to other data-generating distributions is that you need to know and derive the distribution of node features after SAGE convolution under "different matrices of strictly positive affinities for vertices of different labels" [D].