Enhancing Graph Classification Robustness with Singular Pooling

TL;DR

This paper analyzes how flat pooling operations affect the adversarial robustness of graph neural networks in graph classification. It derives theoretical bounds showing that Sum, Avg, and Max pooling impart different vulnerabilities tied to graph structure and model weights, and then introduces RS-Pool, a robust pooling scheme based on the dominant right singular vector of post-message-passing node embeddings. RS-Pool is shown to be differentiable, permutation-invariant, and efficiently computable via power iteration, with a formal robustness bound that depends on the spectral gap and a tunable scale parameter. Empirically, RS-Pool delivers stronger robustness under a variety of attacks with competitive clean accuracy across multiple datasets and backbones, validating its practicality for robust graph-level prediction.

Abstract

Graph Neural Networks (GNNs) have achieved strong performance across a range of graph representation learning tasks, yet their adversarial robustness in graph classification remains underexplored compared to node classification. While most existing defenses focus on the message-passing component, this work investigates the overlooked role of pooling operations in shaping robustness. We present a theoretical analysis of standard flat pooling methods (sum, average and max), deriving upper bounds on their adversarial risk and identifying their vulnerabilities under different attack scenarios and graph structures. Motivated by these insights, we propose \textit{Robust Singular Pooling (RS-Pool)}, a novel pooling strategy that leverages the dominant singular vector of the node embedding matrix to construct a robust graph-level representation. We theoretically investigate the robustness of RS-Pool and interpret the resulting bound leading to improved understanding of our proposed pooling operator. While our analysis centers on Graph Convolutional Networks (GCNs), RS-Pool is model-agnostic and can be implemented efficiently via power iteration. Empirical results on real-world benchmarks show that RS-Pool provides better robustness than the considered pooling methods when subject to state-of-the-art adversarial attacks while maintaining competitive clean accuracy. Our code is publicly available at:\href{https://github.com/king/rs-pool}{https://github.com/king/rs-pool}.

Figures (5)

• Figure 1: Left: Empirical estimation of adversarial risk $\gamma$ and corresponding attack success rate on PROTEINS ((a), (b)) and D&D ((c), (d)). Right (e): Study of the effect of the parameter $\alpha$ which inversely controls $\tau$ on the PROTEINS dataset.
• Figure 2: Effect of the number of iterations on the convergence of the iterative power method. The convergence is computed through the $\ell_2$ distance between the estimated and true dominant singular vectors (obtained via full SVD).
• Figure 3: Extension of Figure \ref{['fig:analysis_of_risk']}: Empirical estimation of adversarial risk $\gamma$ and corresponding attack success rate on PROTEINS ((a), (b)) and D&D ((c), (d)).
• Figure 4: Analysis of the Upper-Bounds provided in Theorem \ref{['theo:main_result']} and their empirical counter-part for different values of $\epsilon$ on the PROTEINS (Upper) and ENZYMES (Lower) Dataset.
• Figure : RS-Pool Forward Pass

Theorems & Definitions (11)

• Definition 4.1
• Theorem 4.2
• Theorem 4.3
• Theorem 5.1
• Corollary 5.2
• Lemma 5.3
• proof
• proof
• proof
• proof