Fig. 2

Robustness to influence attacks using GCNs (solid line) or with the best defense at a given attack success probability (dash line). Results are shown for the CiteSeer, Cora, PolBlogs, and PubMed datasets, each plotted in a subsequent row, and using both the Nettack/SGA (left column) and FGA (right column) attacks. Results were not returned in the allotted time (24 h per trial) for IG-FGSM on all datasets, and FGA for PubMed. Each curve represents the average required budget over 25 randomly selected targets, and error bars are standard errors. Higher is better for the defender. With the exception of the PubMed dataset, GreedyCover performs at least as well as random training selection, and often performs much better