Since graph neural networks (GNNs) are often vulnerable to attack, we need to know when we can trust them. We develop a computationally effective approach towards providing robust certificates for message-passing neural networks (MPNNs) using a Rectified Linear Unit (ReLU) activation function. Because our work builds on mixed-integer optimization, it encodes a wide variety of subproblems, for example it admits (i) both adding and removing edges, (ii) both global and local budgets, and (iii) both topological perturbations and feature modifications. Our key technology, topology-based bounds tightening, uses graph structure to tighten bounds. We also experiment with aggressive bounds tightening to dynamically change the optimization constraints by tightening variable bounds. To demonstrate the effectiveness of these strategies, we implement an extension to the open-source branch-and-cut solver SCIP. We test on both node and graph classification problems and consider topological attacks that both add and remove edges.

翻译：由于图神经网络（GNN）通常容易受到攻击，我们需要知道何时可以信任它们。我们开发了一种计算高效的方法，用于为使用修正线性单元（ReLU）激活函数的消息传递神经网络（MPNN）提供鲁棒性证书。鉴于我们的工作基于混合整数优化，它能够编码多种子问题，例如：（i）允许添加和删除边，（ii）支持全局和局部预算，以及（iii）涵盖拓扑扰动和特征修改。我们的关键技术——基于拓扑的边界收紧——利用图结构来收紧边界。我们还实验了激进边界收紧方法，通过收紧变量边界动态改变优化约束。为证明这些策略的有效性，我们在开源分支切割求解器SCIP上实现了扩展。我们在节点分类和图分类问题上进行了测试，并考虑了同时添加和删除边的拓扑攻击。