Response to Reviewer F8a7
Thanks for your time and effort in reviewing our paper. Here is our point-to-point response to your further questions:
**Q1: are you suggesting that by using RES, $\mathbf{v}’$ still obtains a robust representation after $h$.**
Thanks for your insightful question. We kindly claim that given the perturbed sample $\mathbf{v}’=\mathbf{v}\oplus\delta$, where $||\delta||_0<k$, by using RES in the GCL training and inference phases, the representation of $\mathbf{v}’$ learned by our RES-based encoder $h$ can achieve certifiably robust performance in downstream tasks, that is, $h(\mathbf{v}’)$ has consistently correct prediction in downstream tasks under any perturbation within budget $k$.
**Q3 and Q4: The role of RES during both the training and inference phases. Which part contributes to the robustness?**
Thanks for your insightful question. We kindly claim that RES works both in the training and inference phases, which contributes to the robustness together.
**The role of RES in the inference phase:** RES performs randomized edgedrop smoothing in the inference phase through Monte Carlo. Our motivation is that injecting the randomized edgedrop noise $\epsilon$ to $\mathbf{v}’$ in the inference phase for multiple times will make each perturbed edge in the majority of these samples will be dropped, making these perturbed edges finally drop in the final decision. which makes certifying the robustness of GCL feasible and promises $\mathbf{v}’$’s robust performance. Specifically, based on Sec. 5.2, RES will draw $\mu$ samples of $\mathbf{v}’\oplus\epsilon$. Then we use Monte Carlo to decide the final connection status of the edge by validating if the majority of the $\mu$ samples drop this edge. Thus, **all fake edges in most of the $\mu$ samples will be dropped if selecting high $\beta$**, making these fake edges finally dropped.
**The role of RES in the training phase:** RES is proposed to train a robust encoder in the training phase to eliminate the negative impacts of randomized edgedrop noise in inference, and enhances model utility and robustness of GCL. Specifically, our motivation is that applying RES to test samples in the inference solely may hurt performance in downstream tasks and the certified robustness based on Eq.(8). Thus, we propose robust encoder training for RES in Sec. 5.1 by injecting randomized edgedrop noise into one augmented view during GCL. It ensures the samples with randomized edgedrop noises align in latent class with clean samples under the encoder, thereby mitigating the negative impacts of such noises and further benefiting the robustness and certification of RES.
**Which part contributes to the robustness:** According to the claim above, RES works both in the training and inference phases, which contributes to the robustness together. In the inference phase, our randomized edgedrop smoothing can drop all fake edges if selecting a high $\beta$ to ensure certifiably robust performance under any perturbation within the specific attack budget. In the training phase, our robust encoder training method mitigates the negative impacts of randomized edgedrop noise in inference and enhances the model utility of GCL, further benefiting the robustness and certification of RES.
**The meaning of 'the number of removed structures' in line 373.**
Thanks for your question. The number of removed structures denotes the number of views/graphs where all edges are removed. In the training phase, we usually have two views for GCL training. In the inference phase, we usually have one test graph. Therefore, we use $i\in\\{0,1,2\\}$ and $j\in\\{0,1\\}$ to denote the number of removed structures in the training and testing phases to implement several variants of our model in ablation studies to understand how RES contributes to the robustness of GCL.
We again thank the reviewer for the time and effort in reviewing our paper. If you have any further concerns or questions, please do not hesitate to let us know. We will respond to them timely.