Fig. 4

Summary of cases where StratDegree and GreedyCover do not improve robustness when using informative attributes on synthetic graphs. The alternative methods are considered less robust than random training selection if the adversary’s budget decreases by at least 1 standard deviation for at least 10 out of 20 points on the associated curve in Fig. 3 (attack success probability in multiples of 0.05). They are considered to be similarly robust if the budget is within 1 standard deviation of for over 10 such points. For accuracy, the alternative methods result in lower accuracy if the average accuracy (see Fig. 9 in Appendix B.5) decreases by at least 3% and similar accuracy if it is within 3%. All cases in the table have heterogeneous degree distributions. All cases with lower accuracy have low homophily. The improvement from the alternatives is also degraded as attributes become more informative (from 70% to 90% accuracy based on attributes alone) and clustering coefficient decreases