An artificial-intelligence system can make sense of a complicated network, yet an attacker may not need to touch the cases it must judge. Altering its training examples can be enough to make the system fail. Graphs are playing an important role in many real-world applications, including drug screening, cancer metabolism, protein analysis, resource deployment, cooperative control strategies, and knowledge graph completion.

That matters because these networks are not just abstract diagrams. They are used to study medicines, disease-related processes, proteins, public resources, coordinated machines, and connected stores of knowledge. The study measures how robust some methods are when the training stage is altered through deliberate changes to the input data.

The altered models are then tested on unchanged graphs, by measuring how well they classify them. The focus is the effect of targeted attacks on the process that turns a graph into a compact summary. The attack removes connections judged important, representing data damage or an attack that causes significant information loss in biological networks.

Each whole network is converted into a compact point in a new map, so networks with similar structure can be recognized as close together. This makes it possible to compare and classify entirely new networks without rebuilding the representations of older ones. The test graphs remain unaltered, while the training graphs are attacked according to the chosen strategy and attack budget.

The test samples stay unaltered, while the embedding model is trained on the altered training examples selected for the experiment. The trained model is then applied to produce embedding representations for both the training and testing samples, completing the representation step.

A classifier learns from the training summaries and predicts the test summaries, after which performance is computed. For the small graph collection, every method loses performance toward random guessing when more than a modest share of connections is removed.

The reason is that the original graphs are small, so removing connections leaves too little graph information. The method called FEATHER behaves worst, while iNetpro2vec performs best under moderate attacks. On this small-molecule task, removing connections steadily drives every method toward chance-level classification, regardless of which connections are targeted.

That makes the picture valuable as a clear stress test: the predictions depend heavily on the graph’s links, not just on the items themselves. In the more challenging Kidney dataset, iNetpro2vec always performs better than FEATHER, while FEATHER soon moves toward random guessing as edge removals increase.

iNetpro2vec also performs better than iGraph2Vec without attacks and under smaller attacks. With larger attacks, the two methods show similar robustness. The two methods remain reasonably robust over a limited range for random and betweenness-based removals, and over a larger range for eigenvector- and PageRank-based removals.

Overall, iNetpro2vec appears more robust to edge-removal attacks than the other methods. The difference is especially clear in the PROTEIN benchmark as the attack becomes stronger. In the Kidney benchmark, iGraph2Vec is slightly worse under small attacks but becomes similar under larger ones.

Across the considered benchmarks, iNetpro2vec shows very good robustness even when training data are poisoned through targeted attacks on central connections. On the large, weighted, highly connected Kidney graphs, it behaves similarly to iGraph2Vec, while FEATHER has no success.

The method provides efficient embeddings across different kinds of data and tasks, including graph classification and graph similarity matching, in practice. It also remains robust across the tested benchmarks when its training set is poisoned, even through targeted attacks on more central node connections.

The danger is not limited to changing an answer at the moment it is given: damaging the examples used for learning can weaken the whole system. But some ways of turning networks into useful summaries withstand that damage better than others.