[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-118090-en":3,"doc-seo-118090-105":30,"detail-sidebar-cat-0-en-105":95},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},118090,4398048950312,"Violet","https://ap-avatar.wpscdn.com/avatar/400002538284de19e3c?_k=1778320343897328908",8,"Research & Report","Structure-Aware Robustness Certificates for Graph Classification","Certifying robustness for graph-based machine learning models is essential for safety but existing certificates are often overly restrictive, since they assume the same impact for all node pair flips (edge additions or deletions), effectively yielding isotropic perturbation coverage. This can lead to pessimistic certified radii when certain node pairs are more decisive than others for the predicted label. The proposed randomized smoothing approach injects anisotropic noise over predefined graph regions to produce structure-aware certificates with varying robustness magnitudes. Benefits are validated through synthetic and real-world experiments.","Structure-Aware Robustness Certificates for Graph Classification  \nPierre Osselin* 1 Henry Kenlay* 1 Xiaowen Dong 1  \n1Department of Engineering Science, University of Oxford, Oxford, UK  \nAbstract  \nCertifying the robustness of a graph-based machine learning model poses a critical challenge for safety.  \nCurrent robustness certificates for graph classifiers guarantee output invariance with respect to the total number of node pair flips (edge addition or edge deletion), which amounts to an l0 ball centred on the adjacency matrix. Although theoretically attractive, this type of isotropic structural noise can be too restrictive in practical scenarios where some node pairs are more critical than others in determining the classifier's output. The certificate, in this case, gives a pessimistic depiction of the robustness of the graph model. To tackle this issue, we develop a randomised smoothing method based on adding an anisotropic noise distribution to the input graph structure. We show that our process generates structural-aware certificates for our classifiers, whereby the magnitude of robustness certificatescan vary across different pre-defined structures of the graph. We demonstrate the benefits of these certificates in both synthetic and real-world experiments.  \n1 INTRODUCTION  \nGraph-based machine learning models have made considerable strides in the last couple of years, with applications ranging from NLP [Wu et al., 2023], combinatorial optimization [Drori et al., 2020] and protein function prediction [Gligorijevi et al., 2021] . As these tools become more common, studying their vulnerability to potential adversarial examples becomes paramount for safety.  \nRobustness certification is an active field of research whose goal is to develop certificates guaranteeing invariance of  \n*Equal contribution.  \nthe model prediction with respect to some input perturbations. Diverse methods have been used to achieve this goal, from interval bound propagation [Gowal et al., 2019], convex relaxation [Raghunathan et al., 2018], Lipschitz bounds computation [Huang et al., 2021] or randomised smoothing [Wang et al., 2021] . Given a data point x and a set of perturbed inputs B (x), a robustness certificate verifies that a model's prediction f(x) remains unchanged for all other inputs in the perturbation set. That is, for all x0 2 B (x) it holds that f(x) = f (x0 ) . Often the set of perturbed inputs B(x) is parameterised, for example by a closed-ball Br (x) = fx0 : d (x; x0 ) 􀀔 rg under some distance function d and radius r. In this case, we are interested in knowing the largest r that we can certify for, where r is called the certified radius.  \nIn the context of robustness certification of graph classifiers against structural perturbation, a common choice of perturbation set is the set of all graphs reachable from an input graph x by up to r node pair flips (edge additions and deletions) 1. This corresponds to a closed ball on the upper triangle entries of the adjacency matrix where the distance is induced by the `1 norm and the bottom triangle entries are determined by the constraint that the adjacency matrix is symmetric (assuming for simplicity the graph is unweighted and undirected) . In some cases, however, different node pairs of the graph can be more predictive of the ground truth label than others. A real-world example is classification of molecular structures, where the edges that constitute key substructure (e.g., a ring) are more critical in determining the class label than the rest. A synthetic example is further presented in Fig. 1. In such situations, certifying according to a total number of edge additions or deletions might gives a pessimistic certified radius, because the set of perturbed inputs may include perturbations which consist of flipping many critical node pairs (in terms of determining the graph  \n1We use the terminology of node pair flip instead of edge flip to emphasise that we are considering the addition of edges that do not exist in","cbCaiuh2701FF71J","https://ap.wps.com/l/cbCaiuh2701FF71J","pdf",1788243,1,10,"English","en",105,"# Abstract\n# Introduction\n## Robustness certification for graph classifiers\n## Problem of isotropic structural noise\n## Structure-aware certificates via anisotropic randomised smoothing\n# Existing approaches and motivation\n## Isotropic noise based smoothing\n## Anisotropic noise based smoothing proposal","[{\"question\":\"为什么现有的图分类鲁棒性证书可能过于保守？\",\"answer\":\"因为常见证书按总的节点对翻转数量（边新增或删除）来保证输出不变，把所有节点对的影响视为等价。若某些节点对对标签更关键，证书会覆盖到大量“关键翻转”，从而得到偏保守的认证半径。\"},{\"question\":\"本文提出的结构感知证书具体做了什么？\",\"answer\":\"通过在输入图结构上施加各向异性噪声，随机平滑获得结构感知的鲁棒性证书。其鲁棒性强度会随图的预定义结构区域而变化。\"},{\"question\":\"各向异性噪声与随机平滑之间有什么关系？\",\"answer\":\"随机平滑把基础模型转化为平滑后的模型，从而提供基于高概率的鲁棒性保证。本文通过让节点对翻转概率取决于其所属区域，实现从而得到结构感知的概率鲁棒性证书。\"},{\"question\":\"这些证书如何在实验中展示效果？\",\"answer\":\"文中在合成数据和真实世界实验中验证了结构感知证书的优势，表明其在关键结构区域上更合理反映鲁棒性，而非单一的总翻转度量。\"}]","Structure-Aware Robustness Certificates for Graph Classification | PDF",1785681472,25,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":90,"head_meta":92,"extra_data":94,"updated_unix":28},"structure-aware-robustness-certificates-for-graph-classification","",{"@graph":36,"@context":89},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/structure-aware-robustness-certificates-for-graph-classification/118090/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-02",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81,85],{"name":72,"@type":73,"acceptedAnswer":74},"为什么现有的图分类鲁棒性证书可能过于保守？","Question",{"text":75,"@type":76},"因为常见证书按总的节点对翻转数量（边新增或删除）来保证输出不变，把所有节点对的影响视为等价。若某些节点对对标签更关键，证书会覆盖到大量“关键翻转”，从而得到偏保守的认证半径。","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"本文提出的结构感知证书具体做了什么？",{"text":80,"@type":76},"通过在输入图结构上施加各向异性噪声，随机平滑获得结构感知的鲁棒性证书。其鲁棒性强度会随图的预定义结构区域而变化。",{"name":82,"@type":73,"acceptedAnswer":83},"各向异性噪声与随机平滑之间有什么关系？",{"text":84,"@type":76},"随机平滑把基础模型转化为平滑后的模型，从而提供基于高概率的鲁棒性保证。本文通过让节点对翻转概率取决于其所属区域，实现从而得到结构感知的概率鲁棒性证书。",{"name":86,"@type":73,"acceptedAnswer":87},"这些证书如何在实验中展示效果？",{"text":88,"@type":76},"文中在合成数据和真实世界实验中验证了结构感知证书的优势，表明其在关键结构区域上更合理反映鲁棒性，而非单一的总翻转度量。","https://schema.org",{"og:url":52,"og:type":91,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":93,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":96},[97,101,105,109,114,119,124,127,132,135,138],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":106,"show_sort_weight":107,"slug":108},"Exam",70,"exam",{"id":110,"doc_module":4,"doc_module_name":46,"category_name":111,"show_sort_weight":112,"slug":113},5,"Comic",60,"comic",{"id":115,"doc_module":4,"doc_module_name":46,"category_name":116,"show_sort_weight":117,"slug":118},6,"Technology",50,"technology",{"id":120,"doc_module":4,"doc_module_name":46,"category_name":121,"show_sort_weight":122,"slug":123},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":125,"slug":126},30,"research-report",{"id":128,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":130,"slug":131},9,"Religion & Spirituality",20,"religion-spirituality",{"id":130,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":130,"slug":134},"World Cup","world-cup",{"id":21,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":21,"slug":137},"Lifestyle","lifestyle",{"id":139,"doc_module":4,"doc_module_name":46,"category_name":140,"show_sort_weight":110,"slug":141},19,"General","general"]