Appendices to " GNNGUARD: Defending Graph Neural Networks against Adversarial Attacks "

Results are shown in Table 6. T able 6: Defense performance (multi-class classification accuracy) against influence targeted attacks. Results are shown in Table 7. To evaluate how harmful non-targeted attacks can be for GNNs, we first give results without attack and under attack (without defense), i.e., "Attack" vs. "No Attack" columns The accuracy of even the strongest GNN is reduced by 18.7% on GNN if the defender is used on clean, non-attacked graphs. GNNs when they are attacked.