Enhancing Graph Classification Robustness with Singular Pooling

TL;DR

This paper introduces Robust Singular Pooling (RS-Pool), a novel pooling method for Graph Neural Networks that enhances adversarial robustness in graph classification tasks by leveraging the dominant singular vector of node embeddings.

Contribution

The paper provides a theoretical analysis of standard pooling methods' vulnerabilities and proposes RS-Pool, a model-agnostic pooling strategy that improves robustness against adversarial attacks.

Findings

RS-Pool outperforms traditional pooling methods under adversarial attacks.

Theoretical bounds demonstrate improved robustness of RS-Pool.

Empirical results show maintained accuracy on clean data.

Abstract

Graph Neural Networks (GNNs) have achieved strong performance across a range of graph representation learning tasks, yet their adversarial robustness in graph classification remains underexplored compared to node classification. While most existing defenses focus on the message-passing component, this work investigates the overlooked role of pooling operations in shaping robustness. We present a theoretical analysis of standard flat pooling methods (sum, average and max), deriving upper bounds on their adversarial risk and identifying their vulnerabilities under different attack scenarios and graph structures. Motivated by these insights, we propose \textit{Robust Singular Pooling (RS-Pool)}, a novel pooling strategy that leverages the dominant singular vector of the node embedding matrix to construct a robust graph-level representation. We theoretically investigate the robustness of RS-Pool and interpret the resulting bound leading to improved understanding of our proposed pooling operator. While our analysis centers on Graph Convolutional Networks (GCNs), RS-Pool is model-agnostic and can be implemented efficiently via power iteration. Empirical results on real-world benchmarks show that RS-Pool provides better robustness than the considered pooling methods when subject to state-of-the-art adversarial attacks while maintaining competitive clean accuracy. Our code is publicly available at:\href{https://github.com/king/rs-pool}{https://github.com/king/rs-pool}.