A shot of Cognac to forget bad memories: Corrective Unlearning in GNNs
Unlearning;Graphs;Graph Neural Networks;GNN;Attacks;Manipulations;Removal
Yes
No ethics review needed.
please refer to weakness
1. The paper is well-written and easy to follow.
2. This paper studies an interesting problem in the graph domain.
3. The motivation to identify most affected nodes make sense.
This paper tackles Corrective Unlearning in Graph Neural Networks (GNNs) to counter the spread of manipulated data effects. Existing methods fall short, even with complete knowledge of manipulated data. The proposed method, Cognac, effectively reduces manipulation impacts with only partial information (5% of the manipulated set), restoring most of the ideal model’s performance and surpassing retraining efficiency by 8 times.
1. The experiments use GCN or GAT as backbones. Suppose we have a two-layer GNN; in that case, a node will only impact its 2-hop neighbors through message passing. This makes it confusing why, in Sec 4.1, the authors propose using output logits change as an indicator to find the most affected node.
2. I am concerned about updating the model with Eq. (2). If we have a large number of nodes to unlearn, I believe gradient ascent on $S_f$ would significantly reduce model utility. Could the authors add an experiment to verify this?
3. The experiments are not comprehensive, as they only focus on small graph datasets.
Yes
No ethics review needed.
See the weaknesses.
1. The authors provide a coherent story.
2. Empirical studies on the benchmark dataset are comprehensive.
This work study the corrective unlearning problem for GNNs, where model developers try to remove the adverse effects of manipulated training data from a trained GNN, with realistically only a fraction of it identified for deletion. The authors introduce a new graph unlearning method, Cognac, which can unlearn the effect of the manipulation set even when only 5% of it is identified.
1. When identifying the affected nodes, the inverse features need to be computed. What is the inverse features? The authors then choose the top K% nodes with the largest logit change. How will the chosen nodes influence the results? I suggest the authors provide empirical analysis of the K%. 
2. When calculating the logits change, should the GNN be trained well? I suggest the authors provide more analysis of how the GNN's performance influence on the logits change.
3. The algorithm has two optimization steps. How about the convergence of the algorithm? How to set the parameters of the optimizer?
4. The proposed method lacks justification. I suggest the authors theoretically analyze why selecting the top K% nodes with largest logit change and using the contrastive unlearning objective work.
Yes
No ethics review needed.
See Weaknesses Section.
1. Cognac’s integration of CoGN and AC DC components offers an innovative approach to corrective unlearning in GNNs, utilizing contrastive learning and decoupled optimization to handle the unique challenges posed by graph-structured data.
2. The framework demonstrates strong performance, achieving effective unlearning even when only 5% of manipulated data is identified, thus substantially lowering the typical data requirement for effective unlearning.
3. The experiments are comprehensive, covering various manipulation types, model types, and datasets. The paper’s ablation studies and visualizations provide clear insights into Cognac’s efficacy and the mechanisms behind it.
This paper introduces *Cognac*, a corrective unlearning framework designed for Graph Neural Networks (GNNs) to mitigate the adverse effects of manipulated data, even when only a small subset of compromised nodes or edges is identified. Cognac combines two key components: (1) *Contrastive Unlearning on Graph Neighborhoods* (CoGN), which minimizes the influence of manipulated nodes on neighboring nodes via contrastive learning, and (2) *Ascent-Descent Decoupled* (AC DC) gradient optimization, which unlearns harmful labels by alternating between ascent and descent steps. This method effectively reduces adversarial impact while maintaining efficiency and scalability.
1. The evaluation metrics (ACC_aff and ACC_rem) mentioned in Lines 175–184, Page 4 differ from traditional accuracy metrics, which directly assess model performance on the original data. Does this mean that the model’s performance on the original data was not evaluated? Or does it imply that naive unlearning performance metrics were excluded? For clarity and comprehensive understanding, I suggest including results from standard unlearning metrics for comparison, even if they may not be favorable for the proposed method. Additionally, if ACC_aff and ACC_rem are novel metrics introduced by the paper, please clarify their originality, or otherwise include citations clearly defined in Lines 175–184.
2. The paper could benefit from a more detailed discussion on why malicious node additions degrade GNN performance. While related studies are referenced, incorporating recent studies would provide a more robust context [1, 2, 3, 4].
3. Correct the typo “th” to “the” in Line 432, Page 9.

**References for Additional Context**:
- [1] *Graph Robustness Benchmark: Benchmarking the Adversarial Robustness of Graph Machine Learning*, NeurIPS 2021, Datasets and Benchmarks Track.
- [2] *Mitigating Emergent Robustness Degradation on Graphs while Scaling Up*, ICLR 2024.
- [3] *Chasing All-Round Graph Representation Robustness: Model, Training, and Optimization*, ICLR 2023.
- [4] *Characterizing the Influence of Graph Elements*, ICLR 2023.
Yes
No ethics review needed.
please refer weakness
(1) The proposed graph contrastive unlearning is a novel and interesting concept.

(2) The method presented in this paper is simple and effective, without introducing additional discriminative components.
This paper propose **Cognac** model to tackle corrective unlearning in Graph Neural Networks, efficiently removing the impact of adversarial manipulations, even when only 5% of the manipulation set is identified. It recovers most of the performance of an oracle trained with fully corrected data and is 8x more efficient than retraining from scratch. This makes **Cognac** effective in real-world scenarios with limited knowledge of corrupted data, enhancing GNN robustness post-training.
(1) The experiments in the paper are seriously insufficient. In the graph domain, there are numerous heterophilic and homophilic graphs, such as Wisconsin, Cornell, and Citeseer. The authors only demonstrate results on three graph datasets, which is clearly inadequate.

(2) There are some conceptually similar works [1], and the authors may need to provide a clearer comparison with these related works.

[1] The Heterophilic Snowflake Hypothesis: Training and Empowering GNNs for Heterophilic Graphs
We propose Cognac, a method for unlearning adverse effects of manipulated data from GNNs. It achieves near oracle performance with when a small fraction of the manipulated set is identified for deletion, beating retraining while being 8x efficient.
@inproceedings{
anonymous2024a,
title={A shot of Cognac to forget bad memories: Corrective Unlearning in {GNN}s},
author={Anonymous},
booktitle={Submitted to The Thirteenth International Conference on Learning Representations},
year={2024},
url={https://openreview.net/forum?id=sRdByVBvZq},
note={under review}
}
Graph Neural Networks (GNNs) are increasingly being used for a variety of ML applications on graph data.  As graph data does not follow the independently and identically distributed (i.i.d) assumption, adversarial manipulations or incorrect data can propagate to other datapoints through message passing, deteriorating the model's performance. To allow model developers to remove the adverse effects of manipulated entities from a trained GNN, we study the recently formulated problem of _Corrective Unlearning_. We find that current graph unlearning methods fail to unlearn the effect of manipulations even when the whole manipulated set is known. We introduce a new graph unlearning method, ***Cognac***, which can unlearn the effect of the manipulation set even when only $5$\% of it is identified. It recovers most of the performance of a strong oracle with fully corrected training data, even beating retraining from scratch without the deletion set while being 8x more efficient. We hope our work guides GNN developers in fixing harmful effects due to issues in real-world data post-training.
I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
Unlearning Graphs Graph Neural Networks GNN Attacks Manipulations Removal
I certify that there is no acknowledgement section in this submission for double blind review.
/pdf/87b3daa2d9679bdfbd785496d186399aa75f4394.pdf
learning on graphs and other geometries & topologies
I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
/attachment/0d670cebd200d5c4113caac9d4556fabfdcc5e28.zip
A shot of Cognac to forget bad memories: Corrective Unlearning in GNNs
ICLR 2025 Conference Submission
ICLR.cc/2025/Conference/Submission