Since graph neural networks (GNNs) are often vulnerable to attack, we need to know when we can trust them. We develop a computationally effective approach towards providing robust certificates for message-passing neural networks (MPNNs) using a Rectified Linear Unit (ReLU) activation function. Because our work builds on mixed-integer optimization, it encodes a wide variety of subproblems, for example it admits (i) both adding and removing edges, (ii) both global and local budgets, and (iii) both topological perturbations and feature modifications. Our key technology, topology-based bounds tightening, uses graph structure to tighten bounds. We also experiment with aggressive bounds tightening to dynamically change the optimization constraints by tightening variable bounds. To demonstrate the effectiveness of these strategies, we implement an extension to the open-source branch-and-cut solver SCIP. We test on both node and graph classification problems and consider topological attacks that both add and remove edges.

翻译：由于图神经网络（GNN）常易受攻击，我们需要明确何时可以信任它们。我们开发了一种计算高效的方法，通过使用修正线性单元（ReLU）激活函数来为消息传递神经网络（MPNN）提供鲁棒性证书。由于我们的工作建立在混合整数优化基础上，它能够编码多种子问题，例如支持(i)边的增加与删除、(ii)全局与局部预算，以及(iii)拓扑扰动与特征修改。我们的关键技术——基于拓扑的边界紧缩——利用图结构来收紧边界。我们还试验了激进边界紧缩策略，通过动态收紧变量边界来改变优化约束。为验证这些策略的有效性，我们在开源分支-切割求解器SCIP中实现了扩展。我们在节点分类和图分类问题上进行了测试，并考虑了同时涉及边增加与删除的拓扑攻击。