Research map / Graph learning / GNN architectures

Enhancing Graph Classification Robustness with Singular Pooling

NeurIPS 2025 · Graph learning › GNN architectures · approach: Oversmoothing and heterophily · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Analyzes adversarial risk bounds of flat pooling (sum, average, max) for GCN/GIN graph classifiers and proposes RS-Pool, which pools graphs by the dominant right singular vector of the node embedding matrix (via power iteration), reporting better PGD, random and genetic attack accuracy on TUDatasets.

Problem

Adversarial robustness of graph classification GNNs is underexplored, and the pooling (readout) stage that produces graph-level embeddings has received little attention in robustness research.

Approach

Replace flat pooling with a scaled dominant right singular vector of the node embedding matrix; a Wedin sin-theta argument bounds how much this representation changes under feature perturbations, with the bound depending on the spectral gap of clean embeddings, and power iteration makes it cheap.

Key results

• On D&D under PGD structural attack, RS-Pool reaches 30.4% attacked accuracy versus 16.6% for the next best pooling (Sort-P), an uplift of about 14 points.
• On PROTEINS under PGD structural attack, RS-Pool achieves 51.9% vs 48.5% for TopK-P and 45.8% for Sum.
• Under feature-based PGD on D&D, RS-Pool reaches 51.8% vs 49.9% for SAG.

Measured effects reported in the paper

Surprising findings

• Max pooling attains only 28.2% PGD accuracy on PROTEINS despite being a common readout, far below sum pooling's 45.8%.
• RS-Pool's clean accuracy is not uniformly best; Sum and Sort-P have higher clean accuracy on several datasets (e.g., Sort-P on REDDIT-B 80.0% vs RS-Pool 75.5%).

Limitations

• Relies on a non-trivial spectral gap in the embedding matrix, which varies with depth and topology.
• Power iteration overhead grows with graph density; training time is substantially higher than baseline pooling (e.g., 148.96 s vs 56.95 s for Sum on PROTEINS).
• Theoretical bounds rely on averaged-case risk and Lipschitz/nonexpansive assumptions; the multiplicity-greater-than-one case is only sketched.

Experimental setup

Datasets: PROTEINS D&D NCI1 ENZYMES IMDB-B REDDIT-B ER_MD MSRC_9

Benchmarks: PROTEINS D&D NCI1 ENZYMES IMDB-B REDDIT-B ER_MD MSRC_9

Metrics: classification accuracy (clean and attacked) attack success rate expected adversarial risk estimate

Baselines: Sum pooling Average pooling Max pooling SAG TopK-P PAN-P Sort-P Genetic attack PGD attack

Builds on: Wedin sin-theta theorem GCN GIN SAGPool TopK pooling

Closest papers by meaning

• Geometry-Aware Edge Pooling for Graph Neural Networks (NeurIPS 2025 · similarity 0.90)
• Bounding the Expected Robustness of Graph Neural Networks Subject to Node Feature Attacks (ICLR 2024 · similarity 0.90)
• SkipPool: Improved Sparse Hierarchical Graph Pooling with Differentiable Exploration (AAAI 2025 · similarity 0.89)
• Robust Graph Condensation via Classification Complexity Mitigation (NeurIPS 2025 · similarity 0.88)
• Adversarial Robust Generalization of Graph Neural Networks (ICML 2025 · similarity 0.88)
• Robust Graph Neural Networks via Unbiased Aggregation (NeurIPS 2024 · similarity 0.87)