Paper: Contractive Systems Improve Graph Neural Networks Against Adversarial Attacks (ICLR-2024)

Reviewer comment (Theory):
The analytical results show contractive properties of the feature/adjacency matrix evolution across model layers for a given input. I am unclear how this proves robustness of the GNN model to input or structure perturbation.

Author response:
**Regarding why contractivity improves robustness**: As defined in our original submission (please see Equations (10) and (11)), contractivity leads to the reduction of the sensitivity of network outputs to input perturbations. Because graph attacks are based on input perturbations such as changes to the node features or adjacency matrix, and our CSGNN encapsulates an inductive bias in the form of a contractive system, it learns to fortify itself against graph attacks (i.e., perturbations), thereby improving the robustness of the model. More explicitly, even without the knowledge of the clean adjacency and feature matrices, having a contractive and stable system allows the outputs one gets with perturbed inputs to be close to the one would get feeding in the clean inputs. Indeed, this understanding is also empirically validated throughout our extensive experiments in Section 4. We discuss this point in our Preliminaries section (Section 3), and have now added an appendix section (Appendix A), to provide a better background on contractive systems.

Reviewer comment (Novelty):
Missing comparison to the work “On the robustness of graph neural diffusion to topology perturbations,” NeurIPS 2022. What are the additional things we learn from this current paper? The results in the NeurIPS 2022 paper relate explicitly to robustness w.r.t. input perturbations.

Author response:
**Regarding  "On the robustness of graph neural diffusion to topology perturbations" (NeurIPS 2022)**: We thank you for this important reference, which we now cite and discuss in our revised paper. The most crucial difference is the underlying method, novelty, and the performance of the methods on various benchmarks. While the mentioned paper also takes inspiration from neural diffusion GNNs, it utilizes **only node feature update neural ODEs**. On the contrary, our CSGNN offers a novel **coupled neural ODE that learns both node features and adjacency matrix updates**. This addition is proven to provide improved performance, as reported in the paragraph “Learning contractive adjacency dynamics is beneficial” of Appendix J (of the revised version of the manuscript). As 3 of 4 of the reviewers noted, this is a novel approach.

Reviewer comment (Experiments):
Please give more information on the attack type. Is it inductive, modification/injection, whitebox/blackbox?

Author response:
**Regarding attack type:** We follow the experimental settings in Pro-GNN, which considers inductive poisoning attacks using both white (metattack, nettack) and black box (random) configurations. In our original submission, we mentioned that in our experimental section, in Section 5.2. We have also revised our Introduction to highlight that, following your question.

Reviewer comment (Experiments):
What is the adaptive attack procedure? It seems the paper simply uses unit tests from Mujkanovic et al. (2022). These cannot be considered to be adaptive attacks for the proposed model. Mujkanovic et al. (2022) has emphasized this point too: "we cannot stress enough that this collection does not replace a properly developed adaptive attack".

Author response:
**Regarding adaptive attack**: The reviewer is correct that we use the ‘unit-tests’ from Mujkanovic et al. (2022)., as stated in our original submission. As we discuss in Section 5.2, under the paragraph “Robustness to Adaptive Attacks”, the unit-tests are adaptive in that a different attack can be utilized for a different attack strength. We also note regarding the statement in Mujkanovic et al. (2022), “we cannot stress enough that this collection does not replace a properly developed adaptive attack”, that our goal is not to propose new attacks based on our method but rather to design a defensive mechanism. Thus, our motivation for using those useful unit tests was to be able to compare with recent baselines on challenging test cases, as shown in Figures 4 and 7. To address your concern, we have revised our text to reflect this discussion. Please see our changes in the revised paper, marked in Orange.

Reviewer comment (Experiments):
GNNGuard is mentioned but not used as baseline in Table 1.

Author response:
**Regarding GNNGuard in Table 1**: In our experimental results section, we seek to provide a comprehensive comparison with the latest methods. We did not include GNNGuard in Table 1 because there were no reported results on Metattack using a variable % of attack in the original paper. However, to address the reviewer's question, we provide a comparison below with GNNGuard on Metattack with a 20% perturbation rate and 5 targeted nodes using Nettack, as reported in GNNGuard, both on Cora and on Citeseer.

| Cora |              |                                             |                                           |
|------|--------------|---------------------------------------------|-------------------------------------------|
|      | Method       | Accuracy on Metattack 20% perturbation rate | Accuracy on Nettack with 5 targeted nodes |
|      | GNNGuard     | 72.2                                        | 77.5                                      |
|      | CSGNN (Ours) | 77.4                                   | 83.2                                  |


| Citeseer |              |                                             |                                           |
|----------|--------------|---------------------------------------------|-------------------------------------------|
|          | Method       | Accuracy on Metattack 20% perturbation rate | Accuracy on Nettack with 5 targeted nodes |
|          | GNNGuard     | 71.1                                        | 86.5                                      |
|          | CSGNN (Ours) | 73.0                                        | 84.6                                      |


Those results further highlight the significance of our method, given that in most cases, CSGNN outperforms GNNGuard. We have added those results to our revised paper marked in Orange, in the paragraph titled “Comparison with GNNGuard” of Appendix J.

Reviewer comment (Experiments):
The attacks used do not seem strong enough (I am unclear of their settings as well). E.g., in Table 1, even under 25% attack, GCN still has >40% accuracy. In other related papers on GNN adversarial attacks (e.g., Fig. 1 of Mujkanovic et al. (2022)), usually GCN would have performed much worse with accuracies below 20-30%.

Author response:
**Regarding the strength of the attack**: In our experimental section, we provide results using various settings that follow those presented in Pro-GNN and Mujkanovic et al. (2022). This approach allows us to provide an accurate and comprehensive picture of the current state of GNN defense mechanisms. Furthermore, we would like to kindly note that we include recent tests from  Mujkanovic et al. (2022), that indeed seem to be stronger. Still, even under this harder attack, our CSGNN achieves improved results compared to other methods, as can be seen in Figures 4 and 7.

Reviewer comment (Novelty):
Inadequate Literature Review: The paper's glaring omission of pivotal related works is concerning. The idea of enhancing NN robustness via dynamical systems isn't novel, even within the GNN realm. The authors' failure to acknowledge, let alone differentiate their work from seminal papers [1][2][3][4][5], is a significant oversight.

Author response:
**Regarding literature review:** We thank the reviewer for the important references, which we now include and discuss in our revised version. Specifically, we note that papers [1-4] consider structured grid data (e.g., 2D images), while our work considers graphs and GNNs. Still, we agree it is essential to discuss the papers working on adversarial robustness and following a similar approach to the one we suggest. We have now updated the manuscript, including Appendix E, where the mentioned references and a few more are included and briefly discussed. This appendix is also referenced in the Introduction section of the main body.  Regarding paper [5], it studies the effectiveness of diffusion neural GNNs to graph topology attacks, showing its resilience compared to other methods. This paper is indeed very important and also adds to the motivation for using such networks for defense. Also, please see, regarding your query about the design of Equation (8), that paper [5] proposes a similar definition of the node feature system. Regarding paper [6], it offers a way to generate new injection attacks, while our paper focuses on a defense mechanism for GNNs. We added papers [5,6] to our Related Work section and a discussion of [1-4] to our revised Appendix. Please see our changes in Magenta.


Finally, we would like to mention that the main novelty of our work, which is the learning of a coupled dynamical system that includes the adjacency matrix, is indeed an original contribution of our work, which is not considered in [1-6]. We add to our revised paper Appendix E, that discusses papers [1-4], and include references [5-6] in the “Related Work” section of the main text.

Reviewer comment (Theory):
Lack of Clear Motivation: The paper's design choices seem arbitrary, with many equations appearing devoid of clear rationale. For example:  
>The reasoning behind assuming a piecewise constant function in eq(6).  
>The ambiguity surrounding the gradient operator of $A$ in eq(8).  
>The seemingly ad-hoc design of eq(8) and its alignment with the paper's theorems.  
>The choice to enforce symmetry on $\tilde{\mathbf{K}}_l$.  
>The intricate design of the adjacency matrix update in eq(14) lacks clear justification.  
The paper should not be a mere mathematical exercise; it should be accessible and provide clear motivations for design choices.

Author response:
**Regarding motivation**: We thank the reviewer for the questions. We split our response into different parts according to the questions raised by the reviewer.


(i) The assumption of a piecewise constant function in Equation (6) is a common practice in neural ODEs, and it allows us to assume that we can interpret the learned neural network layers as the discretization of some continuous ODE. This is a very basic assumption, and it is also made in [1] as suggested by the reviewer. Furthermore, we kindly refer the reviewer to the following papers [R1,R2,R3,R4,R5] (cited in our original submission), where a similar assumption is made. To clarify this point, we have revised our text (please see changes in Magenta).  


(ii) We would like to kindly refer the reviewer to the text above Equation (8), where we discuss the motivation for constructing our node dynamics. As stated, “We build upon a diffusion-based GNN layer, (Chamberlain et al., 2021; Eliasof et al.,2021), that is known to be stable, and under certain assumptions is contractive”. That is, the construction of this mechanism allows us to theoretically analyze and explain the behavior of the node feature dynamical system of CSGNN. Using the gradient operator in Equation (8), we rely on the definition made in (Chamberlain et al., 2021; Eliasof et al.,2021). The same definitions are also used in the paper provided by the reviewer (paper [5]). To better accommodate the reviewer’s question, we added an explicit definition of the gradient operator in our revised paper in Appendix B (which used to be Appendix A). We refer to appendix B before equation (8) in our revised version.


(iii) Our choice to keep $\tilde{\mathbf K}_l$ symmetric is not arbitrary. It stems from [R6] (also cited in our original submission), allowing us to view the layers of the GNN as a discretization of a gradient flow. Therefore, it is important so as not to compromise the dynamical system view in our CSGNN. We have revised our paper to include this discussion. 


In addition to the findings in [R6], in our case, it is reasonable to keep $\tilde{\mathbf K}_l$ symmetric so that if it is also learned to be positive definite, then the forward propagation of our node feature system is stable, as pointed out in Appendix A (now Appendix B after the updates introduced in the revised manuscript). Our original submission also provided this discussion; please see the paragraph after Equation (10) up to Section 4.3.




(iv) We would like to note that the design of Equation (14) is far from an arbitrary choice. As discussed in our original submission, we build on the results shown in [R7], to design an equivariant and symmetry-preserving parameterization of the adjacency matrix, which is used to define our adjacency matrix update step. Furthermore, the design of Equation (14) is a major contribution of our work, and it addresses both mathematical and technical challenges in implementing an adjacency matrix dynamical system. We gently ask the reviewer to read our discussion that motivates this structure in Section 4.3.

Reviewer comment (Evaluation):
Computational Overheads: The complete matrix representation in eq(14) suggests significant computational demands. The authors should elucidate the memory and time overheads.

Author response:
**Regarding computational overhead:** The reviewer is correct that learning to modify the adjacency matrix in an end-to-end fashion incurs additional computational overhead. We would like to start by noting that such an approach is not computationally light, regardless of the method (whether our CSGNN or other well-known methods like Pro-GNN [R8]). While such mechanisms do require more computations, they also offer improved performance. 
We now provide a complexity analysis of our CSGNN, followed by a table that reports the training and inference times and memory consumption on an Nvidia RTX-3090 GPU with 24GB of memory, on the Cora dataset.
Theoretically, the added runtime complexity for a CSGNN adjacency matrix learning layer is $O(9 \cdot n^2)$ where $n$ is the number of nodes. Thus, assuming L layers, the overall complexity of a CSGNN network is $O(L(n \cdot c^2 + m\cdot c + 9\cdot n^2))$, whereas node-based ODE systems usually are of runtime complexity $O(L(n \cdot c^2 + m\cdot c))$. Please recall that $n$ is the number of nodes, $m$ is the number of edges in the graph, and the term of $c^2$ stems from the channel mixing term in Equation (8). The factor of 9 stems from the 9 parameters to be learned in Equation (14). 
Below, we report the runtimes and memory consumption of our CSGNN and compare it with CSGNN$_{\textrm{noAdj}}$ (that is, CSGNN without the adjacency matrix update), and Pro-GNN for reference. These experiments were run on the Cora dataset with networks with 64 channels and 2 layers. It can be seen that both CSGNN and Pro-GNN require more resources, however, such an approach offers improved performance. 




| Method          | Train time [ms] | Inference time [ms] | Memory consumption [MB] | Accuracy (%) @ 25% Metattack | Accuracy (%) @ 5 nodes nettack |
|-----------------|-----------------|---------------------|-------------------------|------------------------------|--------------------------------|
| Pro-GNN         | 1681.17         | 1.01                | 1989                    | 69.72                        | 66.21                          |
| CSGNN$_{\textrm{noAdj}}$ | 3.29            | 1.32                | 891                     | 70.25                        | 81.90                           |
| CSGNN           | 9.24            | 5.96                | 1623                    | 74.46                        | 83.29                          |


Also, we note that while both our CSGNN and Pro-GNN propose methods to evolve the adjacency matrix, our CSGNN shows significantly lower training computational time, due to our solution taking the form of a learned neural ODE system for the adjacency matrix, while Pro-GNN solves an optimization problem with feedback to the downstream task (which is also an end-to-end solution, although different than ours). For inference, Pro-GNN uses the fixed adjacency matrix found by training, while our CSGNN evolves the input adjacency matrix using the learned network. This can also be seen as an advantage of CSGNN, as it can be used for inference on different kinds of attacks and, therefore, can potentially generalize to different attacks, and this is a future research direction. 


We also add that investigating the possibility of reducing the computational costs for learning adjacency matrices is an important and interesting topic on its own, that is left for future work.


We added the complexity analysis, reported runtimes, and future directions discussion to our revised paper.

Reviewer comment (Experiments):
Narrow Attack Scope: The paper exclusively focuses on poisoning attacks. Is this indicative of the theorems being specifically tailored for such attacks? The theorem statements, including their assumptions and conclusions, don't seem to impose such constraints. What is the rationale behind primarily considering poisoning attacks? Reference [6] suggests that injection attacks pose a greater threat than poisoning attacks. The authors should address these concerns and expand their experiments to include injection attacks, irrespective of the model's performance against them. Additionally, the inclusion of black-box attacks in the evaluation is necessary. The model exhibits suboptimal performance on the Pubmed dataset. Does this suggest that the efficacy of your models and theorems is dataset-dependent? It would be insightful to understand how the model fares on different datasets, especially those characterized by heterophily.

Author response:
**Regarding attack scope**: We follow the same experimental setting as in [R8], a popular paper whose settings were followed in multiple papers, allowing us to present a broad picture of the adversarial defense capabilities of our CSGNN and compare it with many methods. The Reviewer is correct that our theoretical assumptions are motivated by attacks where the nodes do not change between clean and attacked graphs (i.e., we do not focus on injection attacks). This is also stated in our “Notations” paragraph in Section 3 (“Preliminaries”). Following your question, we revised our Introduction (Section 1) to highlight this fact to enhance the focus of the paper.
Furthermore, we would like to add that while our focus is on poisoning attacks (i.e., not on injection attacks), in principle, we are unaware of any inherent limitation in our presented theoretical results regarding changing the number of nodes, which translates to injection attacks. Therefore, in principle, one could extend our work to injection attacks. However, as previously discussed, this is not the main focus of our paper, and it is left for future work.
 
Regarding black box evaluation, we would like to refer the reviewer to our experiments that include random perturbations in Figures 3, 6, and 9. 

Regarding the Pubmed dataset, we do not agree that our model achieves suboptimal results. Indeed, our CSGNN does not achieve the highest accuracy on all configurations on Pubmed. Still, a close look at our tables will also suggest that no model is perfect and offers the highest results across all datasets and configurations, and this is also not our claim. We claim that CSGNN offers a powerful model that stems from an ODE perspective and is the first model within the family of ODE-inspired GNNs, at least to our knowledge, to also learn the adjacency matrix. As we discuss in this rebuttal and the paper, this construction is non-trivial as it requires preserving the equivariance and symmetry of the adjacency matrix. Our model indeed offers impressive (also according to most of the reviewers) results on most of the datasets and configurations in this paper. Furthermore, we kindly ask the reviewer to look at Figures 5 and 6, where our CSGNN achieves the highest results on Pubmed, and also in Table 4 our results are among the top 3 models. As previously mentioned, in our experiments, we seek to offer a broad comparison with as many models as possible, and this is the motivation that led to the selection of datasets included in our paper.

Reviewer comment (Experiments):
Lack of Large-Scale Graph Datasets: The current evaluation is limited to smaller datasets such as Cora, Citesser, and Polblogs. It would be beneficial to see how the model performs on more extensive, widely-recognized datasets like the ogbn series.

Author response:
**Regarding large datasets**: We would like to refer the reviewer to Appendix I (Appendix J in the updated submission), where we provide results on the larger dataset Pubmed. Since our method includes an adaptive mechanism that alters the adjacency matrix in an end-to-end manner, using even larger datasets can be restrictive (memory-wise, due to the $O(n^2)$ possible edges and the need to keep gradients for backpropagation), which is in line with other GNN defense methods that include a learnable adjacency matrix mechanism, see for example [R8]. For reference, we did manage to run our CSGNN on a GPU with 24GB of memory on Pubmed but could not do the same with Pro-GNN [R8] due to out-of-memory errors. This can be attributed to the rather lightweight parameterization of our adjacency matrix update described in Equation (14).
In addition, we note that employing an adaptive adjacency matrix mechanism to even larger scale datasets is a challenge on its own due to the quadratic complexity in the number of nodes. We agree that it would be interesting to develop methods that can significantly reduce the existing computational costs (which could potentially reduce the complexity of O($n^2$), the maximal number of possible edges). However, as previously discussed in our rebuttal, such development is out of the scope of this paper. The investigation of this research direction can have a large positive impact on the GNN community beyond adversarial defense and is left for future research.

Reviewer comment (Theory):
What are the assumptions behind Theorem 1 & 2?

Author response:
**Regarding the assumptions of Theorems 1 and 2:** In our original submission, we state in Appendix A (now turned to Appendix B, in our revised version), after Equation (16) (now Equation (18)), that we assume the activation function $\sigma$ should be monotonically increasing and 1-Lipschitz. We agree that explicitly adding the assumptions to Theorems 1 and 2 improves the quality and clarity of our paper, and we have now added them to our revised version. Please see our changes, marked in Red.