Paper: Rethinking Label Poisoning for GNNs: Pitfalls and Attacks (ICLR-2024)

Reviewer comment (Writing):
Unconvincing arguments, presentation ambiguity and self-contradiction: (1) Lot of arguments in this paper are not convincing. For example, it says “The first pitfall arises since all previous attacks evaluate on data splits with validation set size much larger than that of the training set (e.g. 500 validation vs 140 train nodes on Cora-ML in the default setting).” Actually, this kind of data partitioning is practical in graph learning as model developers focus on training and validating datasets in the training phase. It is hard to say this is a pitfall. (2) A lot of the statements are ambiguous. For example, it says “We observe that fine-tuning with only 20 configurations can significantly deteriorate the attack performance, as evidenced by an increase in test accuracy.” The configurations are not explained clearly here. (3) Self-contradictive statement. In the beginning, it says that one drawback of related works is they focus on the binary task, however, they can be generalised to multiclass tasks, as shown in the evaluation part of this paper.

Author response:
**W1-1.** *Lot of arguments in this paper are not convincing. For example, it says “The first pitfall arises since all previous attacks evaluate on data splits with validation set size much larger than that of the training set (e.g. 500 validation vs 140 train nodes on Cora-ML in the default setting).” Actually, this kind of data partitioning is practical in graph learning as model developers focus on training and validating datasets in the training phase. It is hard to say this is a pitfall.* 

**Response W1-1.** We strongly disagree with this comment. Unlike other domains (e.g. Computer Vision) in GNNs we are often interested in the sparsely labeled scenario where the number of labeled nodes is relatively small $\mathcal{V}_l \ll \mathcal{V}$. This is the standard in the literature. 

We advocate using validation set that is at most as large as the train set. The pitfall of using large validation set has been extensively studied for semi-supervised learning. The highly influential paper from Oliver et al. (2018) [1] offers an extensive discussion on this pitfall for general semi-supervised learning (see their P.6). To briefly summarize their points, in real-world applications the larger validation set would instead be used as the train set. Another issue is that any objective (e.g. accuracy) used for hyperparameter tuning would be significantly noisier across runs when using a realistically small validation set which disproportionately affects method that are sensitive to h-params. 

It would benefit the discussion if the reviewer can point us to other arguments that they find unconvincing.

[1] Realistic Evaluation of Deep Semi-Supervised Learning Algorithms. Oliver et al., NeurIPS 2018. 

---
---
**W1-2.** *A lot of the statements are ambiguous. For example, it says “We observe that fine-tuning with only 20 configurations can significantly deteriorate the attack performance, as evidenced by an increase in test accuracy.” The configurations are not explained clearly here.*

**Response 1-2.** In the introductory paragraph of our Appendix we provide comprehensive details on the hyper-parameter configurations we use during both attack (paragraph 2) and defense (paragraph 3) phases. We added a forward pointer for clarity in the updated version. Additionally, we share our code which does hyper-parameter tuning and provides additional implementation level details. 

It would benefit the discussion, if the reviewer can point us to other statements that are ambiguous. 

---
---

**W1-3.** *Self-contradictive statement. In the beginning, it says that one drawback of related works is they focus on the binary task, however, they can be generalised to multiclass tasks, as shown in the evaluation part of this paper.*

**Response W1-3.**  We mentioned in our paper that the previous attacks were primarily introduced for binary classes. Then, for a fair comparison, we introduced the multi-class extension of these attacks. We therefore fail to see the contradiction that the reviewer is pointing out to.

Reviewer comment (Evaluation):
Objective Presentations. Broad claims, especially critiques of an entire domain of literature, require comprehensive evidence and careful presentation to avoid potential overgeneralization. For example, the statement that the "entire literature on label poisoning for GNNs is plagued by serious evaluation pitfalls" is a strong assertion. From the segments I reviewed, there wasn't exhaustive and convincing evidence presented to substantiate such a broad critique. While the paper might delve deeper into this in sections I haven't extracted, from the available content, this claim appears to lack detailed supporting examples. 

A research paper's strength lies not just in its findings but also in the clarity and robustness of its evaluation methods. When critiquing other works for evaluation pitfalls, it becomes crucial for the paper to transparently outline its own methodology limitations. Considering these weaknesses in this paper, the authors are suggested to polish this paper carefully.

Author response:
**W3.** *Objective Presentations. Broad claims, especially critiques of an entire domain of literature, require comprehensive evidence and careful presentation to avoid potential overgeneralization. For example, the statement that the "entire literature on label poisoning for GNNs is plagued by serious evaluation pitfalls" is a strong assertion. From the segments I reviewed, there wasn't exhaustive and convincing evidence presented to substantiate such a broad critique. While the paper might delve deeper into this in sections I haven't extracted, from the available content, this claim appears to lack detailed supporting examples.*

**Response W3.** We thank the reviewer for their feedback. While our statements are true they might be considered misleading since there are only a handful of papers on adversarial label poisoning attacks for GNNs. We appropriately softened our statements. 

---
---

**W4.** *"…When critiquing other works for evaluation pitfalls, it becomes crucial for the paper to transparently outline its own methodology limitations."* 

**Response W4.** We already highlighted in the paragraph on Ablations and Limitations (refer to end of Section 5) the limitations of our work. Pasting below the two main limitations of our work for ease of reference.

```
While it may not always be easy to implement our threat models in practice,
we still gain significant insights into the inherent resilience of the models. Our theoretical insights
(Proposition 3) apply only to random flips, and extending this to the worst-case is left for future work
```

We are happy to incorporate any additional limitations that the reviewer might have identified.

Reviewer comment (Evaluation):
Besides, providing some explanation/intuition about the first pitfall of baseline evaluation would be nice. At the moment, the paper just states that existing methods use considerably larger validation sets than training ones, but it doesn't go into the details of why this is a pitfall. Elaborating on this during the second paragraph of Section 3 is much appreciated.

Author response:
We elaborated this point in the updated version. The highly influential paper from Oliver et al. (2018) [1] offers an extensive discussion on this pitfall for general semi-supervised learning (see their P.6). To briefly summarize their points, in real-world applications the larger validation set would instead be used as the train set. Another issue is that any objective (e.g. accuracy) used for hyperparameter tuning would be significantly noisier across runs when using a realistically small validation set which disproportionately affects method that are sensitive to h-params. 

[1] Realistic Evaluation of Deep Semi-Supervised Learning Algorithms. Oliver et al., NeurIPS 2018.

Reviewer comment (Writing):
Could you please explain how the final poisoned label is computed via $\hat{\boldsymbol{Y}}\_{l} = \mathrm{diag}(\boldsymbol{b}) \odot \boldsymbol{H} + \mathrm{diag}(\mathbf{1}\_{L} - \boldsymbol{b}) \odot \boldsymbol{Y}\_{l}$?

Author response:
Instead of Hadamard product, we need a matrix product. Thank you for noticing this typo. 

Correct version: $\widehat{\mathbf{Y}}_l =  \mathrm{diag}(\mathbf{b}) \mathbf{H} + \mathrm{diag} (\mathbf{1}_L - \mathbf{b})  \mathbf{Y}_l $. 

We also updated the paper to reflect this.

Reviewer comment (Experiments):
Some pitfalls proposed are weird to me. I am not sure why the split between training, validation and test should be equal. As a semi-supervised learning task, it is usually to let them differ in my opinion and I am also not sure why the validation set should be poisoned as well since the validation set should be used to select model and do cross-validation.

Author response:
Only the training and validation sets are equal and the remaining nodes correspond to the test set. We advocate using validation set that is at most as large as the train set. The pitfall of using large validation set has been extensively studied for semi-supervised learning. The highly influential paper from Oliver et al. (2018) [1] offers an extensive discussion on this pitfall for general semi-supervised learning (see their P.6). Briefly, one of their critical points is that in real-world applications the larger validation set would instead be used as the train set.

[1] Realistic Evaluation of Deep Semi-Supervised Learning Algorithms. Oliver et al., NeurIPS 2018. 

The basis for poisoning attacks is that we do now know which labels are potentially poisoned. If the defender does have access to a small, clean-label validation set, they could simply ignore the training set and train for a fixed number of epochs on this secure clean validation set. This would render all label-poisoning attacks completely ineffective. We demonstrate this with the experiment in section A.10 in the appendix. 

This is more acute for sparsely-labeled node classification. Unlike other domains (e.g. computer vision) in GNNs we are often interested in the sparsely labeled scenario where the number of labeled nodes is relatively small $\mathcal{V}_l \ll \mathcal{V}$. This is the standard in the literature. Some methods, use all labels for training, while others split $\mathcal{V}_l$ into train/val sets and use the latter for early stopping/fine-tuning. Our attacks remain agnostic to this.

Reviewer comment (Writing):
t is not super clear if the newly proposed approach are using insights coming from the different pitfalls. Especially the HP tuning one.

Author response:
**Response W1/Q4.** Since a similar comment was brought up by multiple reviewers we address it in a joint meta response (see the top comment and the newly added section A.18).

Reviewer comment (Evaluation):
Paragraph 3 mentions the pitfalls of undefended models but defers it to paragraph  ; as a result we cannot get a complete picture of the impact on the performance (and we expect this pitfall to have a large impact as well).

Author response:
**Response W2.** The third pitfall we've identified stems from the fact that prior studies evaluated their attacks on undefended models, such as vanilla GCN and GAT, without considering defense models like CPGCN and RTGNN designed to counter label poisoning attacks.  In our evaluation, we include these defenses and additionally AblationGCN -- a certified defense against feature attacks which can be viewed as an extreme version of label poisoning attack (refer to Fig. 4).

Reviewer comment (Experiments):
As mentioned above, paragraph 3 do not adress the defense-awareness pitfall ; would it be feasible to have a Figure like Fig 2 that takes this pitfall into account ? (if you have the experiments ready).

Author response:
**Response Q2.** In the updated version of the paper we updated Fig. 2 where now the second subplot includes a defense (CPGCN) thus showing how the second pitfall can be addressed.

Reviewer comment (Presentation):
I would suggest to add a number (P1, ..., P6) to refer to each of the pitfalls, which would make the paper easier to read (+ it would also improve the readability of some figures).

Author response:
**Response Q3.** Thank you for the great suggestion. In the updated paper we marked each pitfall with P1 – P6 for clarity and also updated Fig. 2 using these identifiers.

Reviewer comment (Novelty):
You are introducing two new attacks. Did you leverage some insights coming from the 6 pitfalls to define these attacks ?

Author response:
**Response W1/Q4.** Since a similar comment was brought up by multiple reviewers we address it in a joint meta response (see the top comment and the newly added section A.18).