@article{lee2019tight,
  title={Tight certificates of adversarial robustness for randomly smoothed classifiers},
  author={Lee, Guang-He and Yuan, Yang and Chang, Shiyu and Jaakkola, Tommi},
  journal={Advances in Neural Information Processing Systems},
  volume={32},
  year={2019}
}

@article{bojchevski2020efficient,
  title={Efficient robustness certificates for discrete data: Sparsity-aware randomized smoothing for graphs, images and more},
  author={Bojchevski, Aleksandar and Klicpera, Johannes and G{\"u}nnemann, Stephan},
  journal={International Conference on Machine Learning},
  pages={1003--1013},
  year={2020},
  organization={PMLR}
}

@article{shi2020point,
  title={Point-gnn: Graph neural network for 3d object detection in a point cloud},
  author={Shi, Weijing and Rajkumar, Raj},
  journal={Proceedings of the IEEE/CVF conference on computer vision and pattern recognition},
  pages={1711--1719},
  year={2020}
}

@article{drori2020learning,
  title={Learning to solve combinatorial optimization problems on real-world graphs in linear time},
  author={Drori, Iddo and Kharkar, Anant and Sickinger, William R and Kates, Brandon and Ma, Qiang and Ge, Suwen and Dolev, Eden and Dietrich, Brenda and Williamson, David P and Udell, Madeleine},
  journal={2020 19th IEEE International Conference on Machine Learning and Applications (ICMLA)},
  pages={19--24},
  year={2020},
  organization={IEEE}
}

@article{gligorijevic2021structure,
  title={Structure-based protein function prediction using graph convolutional networks},
  author={Gligorijevi{\'c}, Vladimir and Renfrew, P Douglas and Kosciolek, Tomasz and Leman, Julia Koehler and Berenberg, Daniel and Vatanen, Tommi and Chandler, Chris and Taylor, Bryn C and Fisk, Ian M and Vlamakis, Hera and others},
  journal={Nature communications},
  volume={12},
  number={1},
  pages={1--14},
  year={2021},
  publisher={Nature Publishing Group}
}

@article{monti2019fake,
  title={Fake news detection on social media using geometric deep learning},
  author={Monti, Federico and Frasca, Fabrizio and Eynard, Davide and Mannion, Damon and Bronstein, Michael M},
  journal={arXiv preprint arXiv:1902.06673},
  year={2019}
}

@article{cai2005one,
  title={One-sided confidence intervals in discrete distributions},
  author={Cai, T Tony},
  journal={Journal of Statistical planning and inference},
  volume={131},
  number={1},
  pages={63--88},
  year={2005},
  publisher={Elsevier}
}

@article{gilbert1959random,
  title={Random graphs},
  author={Gilbert, Edgar N},
  journal={The Annals of Mathematical Statistics},
  volume={30},
  number={4},
  pages={1141--1144},
  year={1959},
  publisher={JSTOR}
}

@article{sugiyama2015halting,
  title={Halting in random walk kernels},
  author={Sugiyama, Mahito and Borgwardt, Karsten},
  journal={Advances in neural information processing systems},
  volume={28},
  year={2015}
}

@article{lecuyer2019certified,
  title={Certified robustness to adversarial examples with differential privacy},
  author={Lecuyer, Mathias and Atlidakis, Vaggelis and Geambasu, Roxana and Hsu, Daniel and Jana, Suman},
  journal={IEEE Symposium on Security and Privacy (SP)},
  pages={656--672},
  year={2019},
  organization={IEEE}
}

@article{li2018second,
  title={Second-order adversarial attack and certifiable robustness},
  author={Li, Bai and Chen, Changyou and Wang, Wenlin and Carin, Lawrence},
  year={2018}
}

@article{wang2021certified,
  title={Certified robustness of graph neural networks against adversarial structural perturbation},
  author={Wang, Binghui and Jia, Jinyuan and Cao, Xiaoyu and Gong, Neil Zhenqiang},
  journal={Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery \& Data Mining},
  pages={1645--1653},
  year={2021}
}

@article{jia2020certified,
  title={Certified robustness of community detection against adversarial structural perturbation via randomized smoothing},
  author={Jia, Jinyuan and Wang, Binghui and Cao, Xiaoyu and Gong, Neil Zhenqiang},
  journal={Proceedings of The Web Conference 2020},
  pages={2718--2724},
  year={2020}
}

@article{gao2020certified,
  title={Certified robustness of graph classification against topology attack with randomized smoothing},
  author={Gao, Zhidong and Hu, Rui and Gong, Yanmin},
  journal={GLOBECOM 2020-2020 IEEE Global Communications Conference},
  pages={1--6},
  year={2020},
  organization={IEEE}
}

@article{raghunathan2018semidefinite,
  title={Semidefinite relaxations for certifying robustness to adversarial examples},
  author={Raghunathan, Aditi and Steinhardt, Jacob and Liang, Percy S},
  journal={Advances in Neural Information Processing Systems},
  volume={31},
  year={2018}
}

@article{huang2021training,
  title={Training certifiably robust neural networks with efficient local lipschitz bounds},
  author={Huang, Yujia and Zhang, Huan and Shi, Yuanyuan and Kolter, J Zico and Anandkumar, Anima},
  journal={Advances in Neural Information Processing Systems},
  volume={34},
  pages={22745--22757},
  year={2021}
}

@article{debnath1991structure,
  title={Structure-activity relationship of mutagenic aromatic and heteroaromatic nitro compounds. correlation with molecular orbital energies and hydrophobicity},
  author={Debnath, Asim Kumar and Lopez de Compadre, Rosa L and Debnath, Gargi and Shusterman, Alan J and Hansch, Corwin},
  journal={Journal of medicinal chemistry},
  volume={34},
  number={2},
  pages={786--797},
  year={1991},
  publisher={ACS Publications}
}

@article{welling2016semi,
  title={Semi-supervised classification with graph convolutional networks},
  author={Welling, Max and Kipf, Thomas N},
  journal={International Conference on Learning Representations, {ICLR}},
  year={2017}
}

@article{DBLP:conf/iclr/LoshchilovH19,
  author    = {Ilya Loshchilov and
               Frank Hutter},
  title     = {Decoupled Weight Decay Regularization},
  journal = {International Conference on Learning Representations, {ICLR}},
  year      = {2019}
}

@article{gowal2019scalable,
  title={Scalable verified training for provably robust image classification},
  author={Gowal, Sven and Dvijotham, Krishnamurthy Dj and Stanforth, Robert and Bunel, Rudy and Qin, Chongli and Uesato, Jonathan and Arandjelovic, Relja and Mann, Timothy and Kohli, Pushmeet},
  journal={Proceedings of the IEEE/CVF International Conference on Computer Vision},
  pages={4842--4851},
  year={2019}
}

@inproceedings{entezari2020all,
  title={All you need is low (rank) defending against adversarial attacks on graphs},
  author={Entezari, Negin and Al-Sayouri, Saba A and Darvishzadeh, Amirali and Papalexakis, Evangelos E},
  booktitle={Proceedings of the 13th International Conference on Web Search and Data Mining},
  pages={169--177},
  year={2020}
}

@article{wu2019adversarial,
  title={Adversarial examples on graph data: Deep insights into attack and defense},
  author={Wu, Huijun and Wang, Chen and Tyshetskiy, Yuriy and Docherty, Andrew and Lu, Kai and Zhu, Liming},
  journal={arXiv preprint arXiv:1903.01610},
  year={2019}
}

@inproceedings{cohen2019certified,
  title={Certified adversarial robustness via randomized smoothing},
  author={Cohen, Jeremy and Rosenfeld, Elan and Kolter, Zico},
  booktitle={International Conference on Machine Learning},
  pages={1310--1320},
  year={2019},
  organization={PMLR}
}


@inproceedings{zugner2019certifiable,
  title={Certifiable Robustness and Robust Training for Graph Convolutional Networks},
  author={D. Z{\"u}gner and S. G{\"u}nnemann},
  booktitle={Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery \& Data Mining},
  pages={246--256},
  year={2019}
}

@inproceedings{wong2018provable,
  title={Provable defenses against adversarial examples via the convex outer adversarial polytope},
  author={Wong, Eric and Kolter, Zico},
  booktitle={International Conference on Machine Learning},
  pages={5286--5295},
  year={2018},
  organization={PMLR}
}

@inproceedings{bojchevski2019certifiable,
 author = {Bojchevski, Aleksandar and G\"{u}nnemann, Stephan},
 booktitle = {Advances in Neural Information Processing Systems},
 pages = {8319--8330},
 title = {Certifiable Robustness to Graph Perturbations},
 year = {2019}
}


@article{jin2020certified,
  title={Certified robustness of graph convolution networks for graph classification under topological attacks},
  author={Jin, Hongwei and Shi, Zhan and Peruri, Venkata Jaya Shankar Ashish and Zhang, Xinhua},
  journal={Advances in neural information processing systems},
  volume={33},
  pages={8463--8474},
  year={2020}
}

@inproceedings{jin2022certifying,
 author = {Jin, Hongwei and Yu, Zishun and Zhang, Xinhua},
 booktitle = {Advances in Neural Information Processing Systems},
 title = {Certifying Robust Graph Classification under Orthogonal Gromov-Wasserstein Threats},
 year = {2022}
}

@inproceedings{singla2020second,
  title={Second-order provable defenses against adversarial attacks},
  author={Singla, Sahil and Feizi, Soheil},
  booktitle={International conference on machine learning},
  pages={8981--8991},
  year={2020},
  organization={PMLR}
}

@article{wu2023graph,
  title={Graph neural networks for natural language processing: A survey},
  author={Wu, Lingfei and Chen, Yu and Shen, Kai and Guo, Xiaojie and Gao, Hanning and Li, Shucheng and Pei, Jian and Long, Bo and others},
  journal={Foundations and Trends{\textregistered} in Machine Learning},
  volume={16},
  number={2},
  pages={119--328},
  year={2023},
  publisher={Now Publishers, Inc.}
}

@inproceedings{sui2022causal,
  title={Causal attention for interpretable and generalizable graph classification},
  author={Y. Sui and X. Wang and J. Wu and M. Lin and X. He and T.-S. Chua},
  booktitle={ACM SIGKDD Conference on Knowledge Discovery and Data MiningAugust},
  pages={1696–1705},
  year={2022},
  organization={}
}

@inproceedings{shervashidze2009efficient,
  title={Efficient graphlet kernels for large graph comparison},
  author={Shervashidze, Nino and Vishwanathan, SVN and Petri, Tobias and Mehlhorn, Kurt and Borgwardt, Karsten},
  booktitle={Artificial intelligence and statistics},
  pages={488--495},
  year={2009},
  organization={PMLR}
}

@inproceedings{costa2010fast,
  title={Fast neighborhood subgraph pairwise distance kernel},
  author={Costa, Fabrizio and De Grave, Kurt},
  booktitle={Proceedings of the 26th International Conference on Machine Learning},
  pages={255--262},
  year={2010},
  organization={Omnipress; Madison, WI, USA}
}

@misc{gunnemann20,
  author       = {G{\"u}nnemann, Stephan},
  title        = {{ECML-PKDD} 2020 {Keynote}: Certifiable robustness of ML models for graphs},
  howpublished = {\url{https://www.youtube.com/watch?v=HkISG9bdAl0&t=2571s}},
  year         = {2020}
}