4: fort {1,2,,E}do 5: StepP(t) P(t 1)+αt P(t 1) h ℓattack f A+P(t 1), X; θ =train(A+P(t 1),X,y),y i

Feb-8-2026, 10:06:09 GMT–Neural Information Processing Systems 

As introduced in 2, attacks may perturb the adjacency matrixA, the feature matrixX, or both.