# Gnn Adversarial Robustness Eval

> Evaluates the adversarial robustness of Graph Neural Networks against node/edge injection and modification attacks, comparing Hamiltonian-based models against standard GNNs and defense baselines. Use when the user wants to benchmark on Cora, Citeseer, Pubmed, Coauthor, Computers, Ogbn-Arxiv, Polblogs, or asks about evaluating this task. Reports accuracy.

- Skill: `qhjqhj00/gnn-adversarial-robustness-eval` (Agent Skill)
- Install (CLI): `npx skillmds add qhjqhj00/gnn-adversarial-robustness-eval`
- Raw SKILL.md: https://api.skillmd.com/api/skills/qhjqhj00/gnn-adversarial-robustness-eval/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: qhjqhj00 (https://skillmd.com/u/qhjqhj00)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/qhjqhj00/gnn-adversarial-robustness-eval

---


# gnn-adversarial-robustness-eval

> Adversarial Robustness in Graph Neural Networks: A Hamiltonian Approach — Zhao et al. (2023) (arXiv:2310.06396, 2023)

## What this evaluates

Evaluates the adversarial robustness of Graph Neural Networks against node/edge injection and modification attacks, comparing Hamiltonian-based models against standard GNNs and defense baselines.

## Datasets

- **Cora, Citeseer, Pubmed, Coauthor, Computers, Ogbn-Arxiv, Polblogs** — total ?; splits: train (-1), val (-1), test (-1)

## Metrics

- `accuracy` **(primary)** — range: [0, 1]
  - Standard node classification accuracy: the fraction of correctly predicted node labels out of the total test nodes. Computed as (predictions == labels).mean().

## Input / output format

**Input**: Graph adjacency matrix and node feature matrix, potentially perturbed by adversarial attacks (node/edge injection or edge modification).

**Output**: Predicted class label for each node in the graph.

## Scoring recipe

```python
def compute_accuracy(predictions, labels):
    correct = (predictions == labels).sum()
    total = len(labels)
    return correct / total
```

## Common pitfalls

- Black-box attacks use a surrogate model to generate perturbations, which may differ from white-box gradient-based attacks.
- Perturbation rates for modification attacks are varied in 5% increments from 0% to 25%, not fixed.
- Dataset splits follow an inductive 60/10/20 protocol for some datasets, while others use standard transductive splits.

## Evidence (verbatim from paper)

> Our datasets include citation networks (Cora, Citeseer, Pubmed) [51], the Coauthor academic network [52], an Amazon co-purchase network (Computers) [52], and the Ogbn-Arxiv dataset [53]. For inductive learning, we follow the data splitting method in the GRB framework [54], with 60% for training, 10% for validation, and 20% for testing.

## Citation

```bibtex
@misc{zhao2023hamiltoniangnn,
  title={Adversarial Robustness in Graph Neural Networks: A Hamiltonian Approach},
  author={Zhao et al. (2023)},
  year={2023},
  note={arXiv:2310.06396}
}
```

- arXiv: 2310.06396