{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,11]],"date-time":"2026-03-11T01:48:12Z","timestamp":1773193692214,"version":"3.50.1"},"reference-count":255,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T00:00:00Z","timestamp":1775001600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Science Foundation","award":["IIS-2006844"],"award-info":[{"award-number":["IIS-2006844"]}]},{"name":"National Science Foundation","award":["IIS-2144209"],"award-info":[{"award-number":["IIS-2144209"]}]},{"name":"National Science Foundation","award":["IIS-2223769"],"award-info":[{"award-number":["IIS-2223769"]}]},{"name":"National Science Foundation","award":["CNS-2154962"],"award-info":[{"award-number":["CNS-2154962"]}]},{"name":"National Science Foundation","award":["BCS2228534"],"award-info":[{"award-number":["BCS2228534"]}]},{"name":"National Science Foundation","award":["CMMI2411248"],"award-info":[{"award-number":["CMMI2411248"]}]},{"name":"Commonwealth Cyber Initiative Awards","award":["VV1Q24-011"],"award-info":[{"award-number":["VV1Q24-011"]}]},{"name":"Commonwealth Cyber Initiative Awards","award":["VV-1Q25-004"],"award-info":[{"award-number":["VV-1Q25-004"]}]},{"name":"research gift funding from Netflix and Snap"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Knowl. Data Eng."],"published-print":{"date-parts":[[2026,4]]},"DOI":"10.1109\/tkde.2026.3660054","type":"journal-article","created":{"date-parts":[[2026,2,6]],"date-time":"2026-02-06T20:51:44Z","timestamp":1770411104000},"page":"2408-2428","source":"Crossref","is-referenced-by-count":0,"title":["Safety in Graph Machine Learning: Threats and Safeguards"],"prefix":"10.1109","volume":"38","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1273-7694","authenticated-orcid":false,"given":"Song","family":"Wang","sequence":"first","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Virginia, Charlottesville, VA, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7504-6159","authenticated-orcid":false,"given":"Yushun","family":"Dong","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Virginia, Charlottesville, VA, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7321-3822","authenticated-orcid":false,"given":"Binchi","family":"Zhang","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Virginia, Charlottesville, VA, USA"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-2899-9268","authenticated-orcid":false,"given":"Zihan","family":"Chen","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Virginia, Charlottesville, VA, USA"}]},{"given":"Xingbo","family":"Fu","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Virginia, Charlottesville, VA, USA"}]},{"given":"Yinhan","family":"He","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Virginia, Charlottesville, VA, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3148-4453","authenticated-orcid":false,"given":"Cong","family":"Shen","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Virginia, Charlottesville, VA, USA"}]},{"given":"Chuxu","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computing, University of Connecticut, Mansfield, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3932-5956","authenticated-orcid":false,"given":"Nitesh V.","family":"Chawla","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, University of Notre Dame, Notre Dame, IN, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1878-817X","authenticated-orcid":false,"given":"Jundong","family":"Li","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, University of Virginia, Charlottesville, VA, USA"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"ref2","first-page":"145","article-title":"Invariant risk minimization games","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ahuja","year":"2020"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/s10618-014-0365-y"},{"key":"ref4","article-title":"Invariant risk minimization","author":"Arjovsky","year":"2019"},{"key":"ref5","article-title":"GENIE: Watermarking graph neural networks for link prediction","author":"Bachina","year":"2024"},{"key":"ref6","first-page":"1396","article-title":"Personalized subgraph federated learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Baek","year":"2023"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3336191.3371788"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/FOCS.2014.56"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-022-06178-9"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-89847-2_4"},{"key":"ref11","first-page":"837","article-title":"Size-Invariant graph representations for graph classification extrapolations","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Bevilacqua","year":"2021"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.648"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.147"},{"key":"ref14","first-page":"695","article-title":"Adversarial attacks on node embeddings via graph poisoning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Bojchevski","year":"2019"},{"key":"ref15","first-page":"8319","article-title":"Certifiable robustness to graph perturbations","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Bojchevski","year":"2019"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.04.039"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00019"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3631712"},{"key":"ref19","first-page":"25058","article-title":"Not all low-pass filters are robust in graph convolutional networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Chang","year":"2021"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5741"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2022.3200459"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/272"},{"key":"ref23","article-title":"GraphTTA: Test time adaptation on graph neural networks","author":"Chen","year":"2022"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TCSS.2019.2912801"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TCSS.2022.3161016"},{"key":"ref26","article-title":"Fast gradient attack on network embedding","author":"Chen","year":"2018"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3559352"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3502223.3502233"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134083"},{"key":"ref30","first-page":"22131","article-title":"Learning causally invariant representations for out-of-distribution generalization on graphs","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Chen","year":"2022"},{"key":"ref31","article-title":"GNNDelete: A general strategy for unlearning in graph neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Cheng","year":"2023"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3711896.3736848"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1966"},{"key":"ref34","article-title":"Efficient model updates for approximate unlearning of graph-structured data","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Chien","year":"2023"},{"key":"ref35","first-page":"6158","article-title":"Wasserstein barycenter matching for graph size generalization of message passing neural networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Chu","year":"2023"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3265506"},{"key":"ref37","article-title":"GraphEditor: An efficient graph representation learning and unlearning approach","author":"Cong","year":"2022","journal-title":"OpenReview"},{"key":"ref38","first-page":"2189","article-title":"Environment inference for invariant learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Creager","year":"2021"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-024-1510-8"},{"key":"ref40","first-page":"1115","article-title":"Adversarial attack on graph structured data","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Dai","year":"2018"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3308558.3313445"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2022.3144250"},{"key":"ref43","article-title":"Node-Level differentially private graph neural networks","author":"Daigavane","year":"2021"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/2618243.2618277"},{"key":"ref45","article-title":"Adversarial model extraction on graph neural networks","author":"DeFazio","year":"2019"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1016\/j.strusafe.2008.06.020"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2020\/179"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1137\/1.9781611975673.67"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2021.3110982"},{"key":"ref50","article-title":"ELEGANT: Certified defense on the fairness of graph neural networks","author":"Dong","year":"2023"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2025.3587586"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2024.3350671"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3411903"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3404835.3462990"},{"key":"ref55","article-title":"Watermarking graph neural networks via explanations for ownership protection","author":"Downer","year":"2025"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i6.25907"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3336191.3371789"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2019.2957786"},{"key":"ref59","first-page":"35254","article-title":"TwiBot-22: Towards graph-based twitter bot detection","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Feng","year":"2022"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1016\/j.jbi.2012.12.003"},{"key":"ref61","article-title":"SIGN: Scalable inception graph neural networks","author":"Frasca","year":"2020"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3575637.3575644"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-58347-1_10"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33013681"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939754"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2025.3591543"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/TBDATA.2024.3489427"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0150"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2022.3160211"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671792"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450112"},{"key":"ref72","first-page":"1025","article-title":"Inductive representation learning on large graphs","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Hamilton","year":"2017"},{"key":"ref73","first-page":"4094","article-title":"Bayesian graph neural networks with adaptive connection sampling","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Hasanzadeh","year":"2020"},{"key":"ref74","article-title":"Unsolved problems in ML safety","author":"Hendrycks","year":"2021"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1145\/3132847.3132885"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1016\/j.aiopen.2022.09.001"},{"key":"ref77","first-page":"26699","article-title":"Uncertainty quantification over graph with conformalized graph neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Huang","year":"2023"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2023\/426"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM54844.2022.00117"},{"key":"ref80","article-title":"GraphSAC: Detecting anomalies in large-scale graphs","author":"Ioannidis","year":"2019"},{"key":"ref81","first-page":"3543","article-title":"Attention is not explanation","volume-title":"Proc. North Amer. Chapter Assoc. Comput. Linguistics, Hum. Lang. Technol.","author":"Jain","year":"2019"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1186\/s13321-020-00479-8"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.117921"},{"key":"ref84","article-title":"Latent adversarial training of graph convolution networks","volume-title":"Proc. Int. Conf. Mach. Learn. Workshop","author":"Jin","year":"2019"},{"key":"ref85","first-page":"8004","article-title":"Power up! Robust graph convolutional network against evasion attacks based on graph powering","volume-title":"Proc. AAAI Conf. Artif. Intell.","author":"Jin","year":"2019"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1145\/3437963.3441735"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1145\/3447556.3447566"},{"key":"ref88","article-title":"Deceptive fairness attacks on graphs via meta learning","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Kang","year":"2024"},{"key":"ref89","article-title":"Semi-supervised classification with graph convolutional networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Kipf","year":"2017"},{"key":"ref90","first-page":"1885","article-title":"Understanding black-box predictions via influence functions","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Koh","year":"2017"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i12.29239"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2983987"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1145\/3487351.3488325"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2023.3240527"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1007\/11564126_17"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1145\/3555803"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2018.00040"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2025.3593897"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.52202\/068431-0859"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3380171"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2017\/299"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i12.29264"},{"key":"ref103","article-title":"WGLE: Backdoor-free and multi-bit black-box watermarking for graph neural networks","author":"Li","year":"2025"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1089\/big.2020.0070"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1145\/3690624.3709289"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1145\/3320269.3384750"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1145\/3546872"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2024.3386168"},{"key":"ref109","article-title":"Beyond generalization: A survey of out-of-distribution adaptation on graphs","author":"Liu","year":"2024"},{"key":"ref110","first-page":"9720","article-title":"Graph neural networks with adaptive residual","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Liu","year":"2021"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3449989"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2021.3068344"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/BigData50022.2020.9377795"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1145\/3501815"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1145\/3511808.3557238"},{"key":"ref116","article-title":"STFL: A temporal-spatial federated learning framework for graph neural networks","author":"Lou","year":"2021"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00059"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/CISS48834.2020.1570617414"},{"key":"ref119","first-page":"4756","article-title":"Towards more practical adversarial attacks on graph neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Ma","year":"2020"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2021.3118815"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-25082-8_50"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR48806.2021.9413270"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1145\/3616855.3635802"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i10.17080"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1109\/BigData47090.2019.9005983"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1016\/j.drudis.2020.11.027"},{"key":"ref127","first-page":"15524","article-title":"Interpretable and generalizable graph learning via stochastic attention mechanism","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Miao","year":"2022"},{"key":"ref128","article-title":"HG-Adapter: Improving pre-trained heterogeneous graph neural networks with dual adapters","author":"Mo","year":"2024"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484796"},{"key":"ref130","first-page":"10","article-title":"Domain generalization via invariant feature representation","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Muandet","year":"2013"},{"key":"ref131","article-title":"graph2vec: Learning distributed representations of graphs","author":"Narayanan","year":"2017"},{"key":"ref132","first-page":"1690","article-title":"Bayesian semi-supervised learning with graph gaussian processes","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Ng","year":"2018"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1007\/b98874"},{"key":"ref134","article-title":"Releasing graph neural networks with differential privacy guarantees","author":"Olatunji","year":"2023","journal-title":"Trans. Mach. Learn. Res."},{"key":"ref135","article-title":"Representation learning with contrastive predictive coding","author":"Oord","year":"2018"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1016\/j.jmb.2018.05.037"},{"key":"ref138","article-title":"Bayesian graph convolutional neural networks using non-parametric graph learning","author":"Pal","year":"2019"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583547"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM58522.2023.00157"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i6.16616"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1109\/DSAA53316.2021.9564233"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1145\/3459637.3482252"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/488"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1145\/2623330.2623732"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2025.3581578"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2023\/253"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403168"},{"key":"ref149","article-title":"Distributionally robust optimization: A review","author":"Rahimian","year":"2019"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1038\/s41746-018-0029-1"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1186\/1759-4499-2-2"},{"key":"ref152","first-page":"4393","article-title":"Deep one-class classification","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ruff","year":"2018"},{"key":"ref153","article-title":"Distributionally robust semi-supervised learning over graphs","author":"Sadeghi","year":"2021"},{"key":"ref154","article-title":"A survey of graph unlearning","author":"Said","year":"2023"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484565"},{"key":"ref156","first-page":"3223","article-title":"GAP: Differentially private graph neural networks with aggregation perturbation","volume-title":"Proc. USENIX Secur. Symp.","author":"Sajadmanesh","year":"2023"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1145\/3580305.3599517"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833607"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/ab6a04"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1145\/3534678.3539366"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2022.3201243"},{"key":"ref162","article-title":"Data poisoning attack against unsupervised node embedding methods","author":"Sun","year":"2018"},{"key":"ref163","article-title":"Node injection attacks on graphs via reinforcement learning","author":"Sun","year":"2019"},{"key":"ref164","first-page":"15920","article-title":"Adversarial graph augmentation to improve graph contrastive learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Suresh","year":"2021"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-96896-0_20"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i8.26187"},{"key":"ref167","first-page":"21076","article-title":"Rethinking graph neural networks for anomaly detection","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Tang","year":"2022"},{"key":"ref168","doi-asserted-by":"publisher","DOI":"10.1145\/3336191.3371851"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2018\/378"},{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560554"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00050"},{"key":"ref173","first-page":"6983","article-title":"Adversarial attacks on graph classification via Bayesian optimisation","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wan","year":"2021"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-75762-5_6"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354206"},{"key":"ref176","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM54844.2022.00060"},{"key":"ref177","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2024.3353548"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i4.25591"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i13.33581"},{"key":"ref180","article-title":"GraphDefense: Towards robust graph convolutional networks","author":"Wang","year":"2019"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-95-3906-2_25"},{"key":"ref182","article-title":"Graph foundation models: A comprehensive survey","author":"Wang","year":"2025"},{"key":"ref183","first-page":"624","article-title":"Defending against data-free model extraction by distributionally robust defensive training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wang","year":"2023"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3497753"},{"key":"ref185","article-title":"A survey of trustworthy graph learning: Reliability, explainability, and privacy protection","author":"Wu","year":"2022"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1038\/s41467-022-30714-9"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833806"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/669"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583521"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i9.26231"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.1145\/3580305.3599271"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1145\/3366423.3380219"},{"key":"ref193","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2019.00075"},{"key":"ref194","article-title":"Handling distribution shifts on graphs: An invariance perspective","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wu","year":"2022"},{"key":"ref195","doi-asserted-by":"publisher","DOI":"10.52202\/079017-0297"},{"key":"ref196","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i9.26239"},{"key":"ref197","article-title":"Discovering invariant rationales for graph neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wu","year":"2022"},{"key":"ref198","first-page":"18839","article-title":"Federated graph classification over non-IID graphs","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Xie","year":"2021"},{"key":"ref199","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583471"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-93037-4_19"},{"key":"ref201","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-019-1211-x"},{"key":"ref202","doi-asserted-by":"publisher","DOI":"10.1145\/3603620"},{"key":"ref203","doi-asserted-by":"publisher","DOI":"10.1145\/3459637.3482299"},{"key":"ref204","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP57164.2023.00072"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/550"},{"key":"ref206","article-title":"How powerful are graph neural networks?","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xu","year":"2019"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-05936-0_35"},{"key":"ref208","article-title":"Cap: Co-adversarial perturbation on weights and features for improving generalization of graph neural networks","author":"Xue","year":"2021"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645693"},{"key":"ref210","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2023.3290792"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-23551-2_2"},{"key":"ref212","doi-asserted-by":"publisher","DOI":"10.1145\/3690624.3709186"},{"key":"ref213","first-page":"79748","article-title":"FedGCN: Convergence and communication tradeoffs in federated training of graph convolutional networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Yao","year":"2022"},{"key":"ref214","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2023.3271677"},{"key":"ref215","article-title":"Graph domain adaptation via theory-grounded spectral regularization","volume-title":"Proc. Int. Conf. Learn. Representations","author":"You","year":"2023"},{"key":"ref216","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2025.3639985"},{"key":"ref217","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.240798"},{"key":"ref218","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01118"},{"key":"ref219","article-title":"Mitigating severe robustness degradation on graphs","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Yuan","year":"2024"},{"key":"ref220","doi-asserted-by":"publisher","DOI":"10.1609\/icwsm.v15i1.18111"},{"key":"ref221","doi-asserted-by":"publisher","DOI":"10.1016\/j.chaos.2020.110121"},{"key":"ref222","article-title":"Adversarial attacks on fairness of graph neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Zhang","year":"2024"},{"key":"ref223","article-title":"PPSGCN: A privacy-preserving subgraph sampling based distributed GCN training method","author":"Zhang","year":"2021"},{"key":"ref224","article-title":"Chasing all-round graph representation robustness: Model, training, and optimization","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Zhang","year":"2023"},{"key":"ref225","first-page":"5453","article-title":"Federated adaptation for foundation model-based recommendations","volume-title":"Proc. Int. Joint Conf. Artif. Intell.","author":"Zhang","year":"2024"},{"key":"ref226","doi-asserted-by":"publisher","DOI":"10.1145\/3459637.3482161"},{"key":"ref227","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2024.3369017"},{"key":"ref228","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/330"},{"key":"ref229","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-emnlp.43"},{"key":"ref230","first-page":"6671","article-title":"Subgraph federated learning with missing neighbor generation","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhang","year":"2021"},{"key":"ref231","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2927365"},{"key":"ref232","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-97-2253-2_28"},{"key":"ref233","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/606"},{"key":"ref234","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2024.3454328"},{"key":"ref235","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33015829"},{"key":"ref236","first-page":"2989","article-title":"Detection and defense of topological adversarial attacks on graphs","volume-title":"Proc. Int. Conf. Artif. Intell. Statist.","author":"Zhang","year":"2021"},{"key":"ref237","doi-asserted-by":"publisher","DOI":"10.1093\/biomet\/asx042"},{"key":"ref238","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645507"},{"key":"ref239","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2020.2981333"},{"key":"ref240","doi-asserted-by":"publisher","DOI":"10.1089\/big.2021.0069"},{"key":"ref241","doi-asserted-by":"publisher","DOI":"10.1145\/3580305.3599373"},{"key":"ref242","doi-asserted-by":"publisher","DOI":"10.1109\/ISDFS52919.2021.9486352"},{"key":"ref243","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2024.3438238"},{"key":"ref244","first-page":"11458","article-title":"Robust graph representation learning via neural sparsification","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zheng","year":"2020"},{"key":"ref245","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2021.3119326"},{"key":"ref246","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i01.5482"},{"key":"ref247","first-page":"27965","article-title":"Shift-Robust GNNs: Overcoming the limitations of localized graph training data","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhu","year":"2021"},{"key":"ref248","first-page":"1766","article-title":"Transfer learning of graph neural networks with ego-graph information maximization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhu","year":"2021"},{"key":"ref249","doi-asserted-by":"publisher","DOI":"10.1016\/j.patter.2022.100521"},{"key":"ref250","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2022.3185151"},{"key":"ref251","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645322"},{"key":"ref252","doi-asserted-by":"publisher","DOI":"10.1145\/3534678.3539093"},{"key":"ref253","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3220078"},{"key":"ref254","article-title":"Adversarial attacks on graph neural networks via meta learning","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Z\u00fcgner","year":"2019"},{"key":"ref255","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330905"}],"container-title":["IEEE Transactions on Knowledge and Data Engineering"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/69\/11427039\/11372973-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/69\/11427039\/11372973.pdf?arnumber=11372973","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,10]],"date-time":"2026-03-10T05:22:32Z","timestamp":1773120152000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11372973\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4]]},"references-count":255,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tkde.2026.3660054","relation":{},"ISSN":["1041-4347","1558-2191","2326-3865"],"issn-type":[{"value":"1041-4347","type":"print"},{"value":"1558-2191","type":"electronic"},{"value":"2326-3865","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4]]}}}